Exfilsquad
Also known as ExfilSquad
Reports
24
First seen
Jul 26, 2026
Last seen
Aug 17, 2026
Motivation
Financial
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
×1×13
United States×13
United Kingdom×5
Nigeria×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1190 Exploit Public-Facing Application ×5T1005 Data from Local System ×5T1041 Exfiltration Over C2 Channel ×5T1566 Phishing ×3T1567 Exfiltration Over Web Service ×3T1059 Command and Scripting Interpreter ×3T1219 Remote Access Software ×2T1486 Data Encrypted for Impact ×2T1078 Valid Accounts ×2T1530 Data from Cloud Storage ×1T1555 Credentials from Password Stores ×1T1526 Cloud Service Discovery ×1
Indicators
cve ×40domain ×40ip_v4 ×25hash_sha256 ×5filename ×2hash_md5 ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2024-42009 (exploited)CVE-2025-5777 (exploited)CVE-2026-14863 (exploited)CVE-2026-15409 (exploited)CVE-2026-15410 (exploited)CVE-2026-18412CVE-2026-20337CVE-2026-20338CVE-2026-20339CVE-2026-20345CVE-2026-20346CVE-2026-20347CVE-2026-20348CVE-2026-20349CVE-2026-20685CVE-2026-25089 (exploited)CVE-2026-26035CVE-2026-27302CVE-2026-39808 (exploited)CVE-2026-43637
Recent reports
Critical