Ransomware group profile · #259 by claimed victims

Exitium ransomware

Exitium is a data extortion group first observed in early 2026, operating a Tor-based double extortion site and targeting victims via bulk data exfiltration followed by public naming-and-shaming, with known victims including a Brazilian agro-industrial firm and a US county appraisal district.

Active First seen Mar 2026

4Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

3Countries hit

1Leak-site URLs tracked, 0 online

14 Apr 2026Latest claim recorded

Victimology

Who Exitium claims to have breached, from 4 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Agriculture and Food Production1

Energy & Utilities1

Government & Defense1

Healthcare1

Top countries

United States2

Brazil1

Taiwan1

Latest claimed victims 4 most recent

Victim	Sector	Country	Claimed
Gastroenterology & Hepatology of CNY gandhofcny.com	Healthcare	US	14 Apr 2026
Ming Hwei Energy mhe.com.tw	Energy & Utilities	TW	29 Mar 2026
Marborges Agroindustria marborges.com.br	Agriculture and Food Production	BR	23 Mar 2026
Fannin CAD fannincad.org	Government & Defense	US	17 Mar 2026

All 4 Exitium victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Exitium is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Exitium ransomware still active?

Exitium is tracked as active. The most recent leak-site claim VULONE recorded is dated 14 April 2026.

How many victims has Exitium claimed?

VULONE has recorded 4 leak-site victim claims attributed to Exitium since March 2026, across 3 countries and 4 sectors.

Which industries does Exitium target?

The sectors most often named on the Exitium leak site are Agriculture and Food Production, Energy & Utilities, Government & Defense.

Which countries are most affected by Exitium?

Most Exitium victims recorded by VULONE are located in United States, Brazil, Taiwan.

Where does VULONE get Exitium victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].