Ethical Hacking News
ExfilSquad, a new cybercrime group, has targeted 13 organizations across the US, UK, and Sweden, exploiting cloud portals to steal sensitive information and sharing it via torrent files. The group's tactics have raised concerns about global reach and sophistication, highlighting the need for robust cybersecurity measures and incident response planning.
ExfilSquad, a new cybercrime group, has been linked to multiple data breaches in the US, UK, and Sweden. The group exploits misconfigured Microsoft Dataverse, Power Pages sites, Case Management and Customer Relationship Management Systems (CRMs) to breach sensitive information. ExfilSquad uses peer-to-peer (P2P) networks to distribute stolen data through torrent files, causing reputational and financial damage to victim organizations. The group's actions highlight the importance of robust cybersecurity measures, incident response planning, and securing cloud infrastructure.
ExfilSquad, a newly emerged cybercrime group, has been making headlines for its brazen data breaches and threatening tactics. In a recent move, the group targeted 13 organizations across the US, UK, and Sweden, exploiting cloud portals to steal sensitive information and using torrent files to share stolen data with a wider audience.
According to reports, ExfilSquad's tactics, techniques, and procedures (TTPs), revolve around misconfigured Microsoft Dataverse, Power Pages sites, Case Management and Customer Relationship Management Systems (CRMs). The group's modus operandi has already gained attention due to its involvement in the cyberattack on the UK’s Police National Legal Database (PNLD), which compromised contact data of more than 100,000 police officers and criminal justice professionals.
The ExfilSquad group is leveraging peer-to-peer (P2P) networks to distribute stolen data by using torrent files. This approach has already been used by other notorious groups such as LockBit 3.0 and Cl0p ransomware. Each victim is assigned a unique torrent tracker and an initial web seed, which is a notable tactic employed by the group.
The use of P2P networks to share stolen data amplifies the reputational and financial damage to victim organizations. According to Resecurity, once stolen data has been released, it is not possible to stop its sharing via the P2P network or remove the torrent file, because other participants involved in seeding can easily resume downloads.
The hosts from China and Russia were among the most active during August 7, 2026, which may suggest that the operators behind them had prior knowledge of the data publication or were involved in its distribution at a later stage once it became available. This raises concerns about the global reach and sophistication of ExfilSquad's tactics.
ExfilSquad's actions highlight the importance of robust cybersecurity measures and incident response planning for organizations across various sectors. The group's use of cloud portals to exploit sensitive information underscores the need for companies to ensure that their cloud infrastructure is properly configured and secured.
As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and take proactive steps to protect themselves against emerging threats like ExfilSquad. By understanding the tactics and techniques employed by groups like this, organizations can better prepare themselves for potential data breaches and minimize the damage caused by such attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/ExfilSquad-The-New-Threat-in-Cybercrime---A-Global-Data-Breach-Nightmare-ehn.shtml
https://securityaffairs.com/197025/security/exfilsquad-targets-new-victims-shares-data-via-torrents.html
Published: Tue Aug 11 13:33:04 2026 by llama3.2 3B Q4_K_M
