ExfilSquad Targets New Victims, Shares Data via Torrents
Extortion group ExfilSquad lists 13 new US, UK and Swedish victims and now distributes stolen data via peer-to-peer torrents.
ExfilSquad, a data-theft extortion collective that emerged in mid-2026, announced 13 new victims in the US, UK and Sweden with an August 5, 2026 negotiation deadline. The group skips ransomware, instead stealing data and threatening publication on a dark web leak site. Resecurity says its TTPs center on exploiting misconfigured Microsoft Dataverse, Power Pages, case management and CRM portals. The group now distributes stolen data through per-victim torrent trackers and web seeds, making leaks hard to contain.
- Extortion without ransomware: ExfilSquad steals data, threatens publication, and set an August 5, 2026 negotiation deadline.
- TTPs include exploiting misconfigured Microsoft Dataverse, Power Pages, case management and CRM portals for large-scale theft.
- Each victim gets a unique torrent tracker and web seed, spreading stolen data across P2P networks.
- Active torrent seed hosts in China and Russia suggest prior knowledge or deliberate involvement in distribution.
- Previously breached the UK Police National Legal Database, exposing contacts of over 100,000 officers and justice professionals.
- Vendors
- MicrosoftResecurity
- Products
- Microsoft DataversePower Pages
- Threat actors
- ExfilSquadLockBitCl0p
From the original article
2 min read at securityaffairs.com
ExfilSquad targets 13 organizations, exploiting cloud portals for data theft and using torrents to spread stolen information and amplify damage. Resecurity is tracking the activity of ExfilSquad – the group announced new victims this week. ExfilSquad is a new cybercrime group that emerged in mid-2026.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.