Ransomware Group intelligence

ExfilSquad

Active

Track ExfilSquad with 28 published victims and 1 known leak locations in a single intelligence view.

Victims 28 Known published victims in this dataset
First discovered 2026-07-26 Earliest victim discovery date
Last discovered 2026-07-26 Latest victim discovery date
Inactive since 0 days Days since the latest known victim
Top country United States 18 victims
Known locations 1 Leak or negotiation infrastructure tracked

Overview

ExfilSquad is tracked by Breach House as a ransomware group with 28 published victims.

United States is currently the most targeted country in this dataset.

1 known leak locations are currently associated with this group.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (1)

    Label Type Availability Links
    Leak location 1 Onion service Unknown exfil5gqmbxrg6yky5aeitkdj7kfwxxjh3wxzrtlewjqi2x67o634iyd.onion

    Top Activity Sectors

    No sector intelligence available.

    Research Sources

    No external research sources linked yet.

    Victims (28)

    Search, filter and paginate the victim timeline for ExfilSquad. Showing 1–28 of 28.

    Type Target Discovered Country Business Category Intel Link
    Ransomware Analog Devices id30862 View details United States Manufacturing / Engineering
    Ransomware Analog Devices id30862 View details United States Manufacturing / Engineering
    Ransomware Bonava id30863 View details Sweden Construction / Real Estate
    Ransomware Bonava id30863 View details Sweden Construction / Real Estate
    Ransomware City of Atlanta id30864 View details United States Public Sector
    Ransomware City of Atlanta id30864 View details United States Public Sector
    Ransomware City of Houston id30865 View details United States Public Sector
    Ransomware City of Houston id30865 View details United States Public Sector
    Ransomware Viavi Solutions id30866 View details United States IT
    Ransomware Viavi Solutions id30866 View details United States IT
    Ransomware Newcastle University id30867 View details United Kingdom Education
    Ransomware Newcastle University id30867 View details United Kingdom Education
    Ransomware District of Columbia Public Schools id30868 View details United States Education
    Ransomware District of Columbia Public Schools id30868 View details United States Education
    Ransomware Zenith Bank Plc id30869 View details Nigeria Finance / Legal / Insurance
    Ransomware Zenith Bank Plc id30869 View details Nigeria Finance / Legal / Insurance
    Ransomware Frontier Airlines id30870 View details United States Transportation / Travel / Logistics
    Ransomware Frontier Airlines id30870 View details United States Transportation / Travel / Logistics
    Ransomware TaylorMade & Sun Day Red golf id30871 View details United States Manufacturing / Engineering
    Ransomware TaylorMade & Sun Day Red golf id30871 View details United States Manufacturing / Engineering
    Ransomware Allstate id30872 View details United States Finance / Legal / Insurance
    Ransomware Allstate id30872 View details United States Finance / Legal / Insurance
    Ransomware Microsoft id30873 View details United States IT
    Ransomware Microsoft id30873 View details United States IT
    Ransomware Police National Legal Database id30874 View details United Kingdom Public Sector
    Ransomware Police National Legal Database id30874 View details United Kingdom Public Sector
    Ransomware UK Department for Education id30875 View details United Kingdom Public Sector
    Ransomware UK Department for Education id30875 View details United Kingdom Public Sector