The cybercrime group ExfilSquad, which emerged in mid-2026, has announced new victims, targeting 13 organizations across the U.S., the UK, and Sweden. This follows a previous attack in July against a major financial institution in Nigeria. The group's modus operandi involves stealing data and threatening to publish it on a dark web leak site if a ransom is not paid, rather than deploying ransomware.
ExfilSquad has set an August 5, 2026, deadline for negotiations with its latest victims, after which it claims the stolen data will be released. The group's tactics, techniques, and procedures (TTPs) primarily involve exploiting cloud and SaaS portals to facilitate large-scale data theft. Specific targets of exploitation include misconfigured Microsoft Dataverse and Power Pages sites, as well as Case Management and Customer Relationship Management (CRM) systems.
The group gained significant attention following a cyberattack on the U.K.'s Police National Legal Database (PNLD), which resulted in the compromise of contact information for over 100,000 police officers and criminal justice professionals.
A notable tactic employed by ExfilSquad is the use of peer-to-peer (P2P) networks and torrent files to distribute stolen data. This approach, previously observed with ransomware groups like LockBit 3.0 and Cl0p, involves assigning each victim a unique torrent tracker and an initial web seed. This method makes the leaked data easily accessible to a wider audience, including other malicious actors, and complicates efforts to prevent its further circulation due to the decentralized nature of P2P networks.
Cybersecurity researchers have analyzed the nodes and seeds involved in the torrent sharing. Observations from August 7, 2026, indicated that hosts located in China and Russia were among the most active participants in the data circulation. This activity suggests either prior knowledge of the data publication by these operators or their involvement in its distribution once it became available.
