ExfilSquad Extortion Group Confirmed Holding Data From 13 Organizations — Detection and Hardening Guide for Data Exfiltration Defense

Researchers have confirmed that the extortion group ExfilSquad is in possession of sensitive data stolen from at least 13 organizations, after the group began publishing leaked datasets via torrents. This is a data-leak extortion campaign — the modern evolution of ransomware economics where the payload is not encryption, but the credible threat of public exposure.

The details that matter for defenders:

• 13 confirmed victims with verified sensitive data in the group's hands — this is not bluff extortion; researchers validated the datasets.
• Torrent-based distribution of stolen data, which makes takedown nearly impossible. Unlike a clearnet leak site that can be seized or DDoS'd, a swarm of seeders replicates your data globally within hours of the magnet link being shared.
• The victim count implies an operational tempo and repeatable intrusion methodology — this group has a working playbook for gaining access, locating sensitive data, staging it, and exfiltrating it without tripping alarms in a dozen-plus environments.

If you are reading this thinking "we weren't named, so this doesn't apply to us" — that is precisely the assumption that gets organizations onto victim list number 14. Pure-exfiltration intrusions are frequently discovered months after initial access, often only when the extortion email arrives. The absence of ransomware noise is the point.

This post covers how these intrusions actually unfold, what you can detect today, and how to harden against the exfiltration phase — the one phase where you can still win even after initial access has failed.

Technical Analysis: How Pure-Exfiltration Extortion Operations Work

No CVE is associated with this campaign in the reporting, and that is typical. Data-extortion groups like ExfilSquad rarely rely on a single exotic vulnerability. Their access playbook is built from well-understood components:

Initial Access Vectors (Observed Across Comparable Campaigns)

1. Compromised credentials against remote access services — VPN concentrators, RDP gateways, and VDI brokers without MFA remain the top entry point for extortion crews. Credential-stuffing against internet-facing portals using breach corpuses is cheap and effective.
2. Exploitation of edge devices and file transfer platforms — the past 24 months have demonstrated repeatedly that internet-facing file transfer appliances and remote access products are the highest-value initial access targets for exactly this type of actor.
3. Purchased access — many extortion groups don't break in at all; they buy initial access broker (IAB) output: valid VPN sessions, webshells on edge devices, or RMM tool persistence already deployed by a separate actor.

The Intrusion Lifecycle Defenders Must Model

The attack chain for a data-theft-only operation differs from ransomware in one critical way: the actor's goal is silence. There is no detonation event. The phases:

1. Persistence — webshells on edge devices, rogue accounts, RMM tooling (legitimate tools like AnyDesk, ScreenConnect, Atera abused for access), scheduled tasks.
2. Discovery — the actor hunts for data worth extorting: file shares, SharePoint/OneDrive, databases, HR systems, legal repositories, backup catalogs. Watch for directory enumeration of file servers and share discovery.
3. Collection and staging — bulk archiving with 7z.exe, rar.exe, or tar into a staging directory, often on a file server or a jump host. Archive naming is frequently generic (backup.zip, data.7z, export.rar).
4. Exfiltration — the highest-fidelity detection opportunity. Common tooling: rclone (configured against Mega, S3, Backblaze, or actor-controlled storage), WinSCP/FileZilla over SFTP, direct HTTPS uploads to cloud storage, or chunked outbound transfers over days to stay under volumetric alerts.
5. Extortion and publication — victim contact, proof-of-theft samples, countdown timers, and finally torrent distribution as seen with ExfilSquad, ensuring permanent, decentralized availability of the leaked data.

Exploitation Status

• Active campaign: Confirmed. 13 victims with verified stolen data.
• Leak mechanism: Torrent-based publication — confirmed in the wild. This is an operational, ongoing extortion ecosystem, not a theoretical threat.
• No CVE / no CISA KEV entry applies to this news item. The defensive lesson is behavioral, not patch-centric: these intrusions succeed because exfiltration and staging behaviors go undetected, not because a single CVE was missed.

Why Torrent Distribution Changes Your Risk Calculus

Once data is torrented, containment of the leak itself is over. Legal injunctions and takedown requests have no meaningful effect on a distributed swarm. This shifts 100% of defensive value to pre-publication: detecting the intrusion during discovery, staging, or exfiltration. Your IR retainer, legal counsel, cyber insurance carrier, and breach notification obligations all activate the moment exfiltration succeeds — your only lever is making sure it doesn't, or catching it before the actor does.

Detection & Response

The detections below target the behaviors that are common across data-extortion intrusions: mass archive creation, exfiltration tooling execution, and anomalous outbound transfer volume. These are tuned to minimize noise — rclone and 7-Zip are legitimate tools, so the detections pair execution with contextual filters your SOC should baseline against known admin and backup activity.

Sigma Rules

---
title: Mass Archive Creation With Common Exfiltration Tools
id: 3f8a1c94-2b6d-4e71-9a05-c7d2e8f41023
status: experimental
description: Detects execution of archiving utilities with command-line patterns consistent with bulk data staging for exfiltration, including recursive compression with passwords and multi-volume output commonly observed in extortion intrusions.
references:
  - https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - '-p'
      - '-r'
      - '-v'
      - '-m'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup and software packaging operations — baseline known admin workstations and backup servers and filter by user/host
level: medium
---
title: Cloud Sync and Exfiltration Tool Execution
id: 9d41b7e2-5c38-4f06-b2a9-1e7d3c8f6542
status: experimental
description: Detects execution of Rclone, MEGAcmd, or similar command-line file transfer utilities frequently abused by extortion actors for bulk data exfiltration to actor-controlled cloud storage.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAcmd.exe'
      - '\mega-cmd.exe'
      - '\filezilla.exe'
      - '\winscp.exe'
  filter_legit_paths:
    Image|startswith:
      - 'C:\Program Files\Rclone\'
      - 'C:\Program Files (x86)\FileZilla FTP Client\'
  condition: selection and not filter_legit_paths
falsepositives:
  - Approved file transfer workflows — maintain an allowlist of sanctioned install paths and service accounts
level: high
---
title: File Share Enumeration Preceding Bulk Collection
id: 62c8e4a1-7f09-4b53-8d16-a3e5b9c20781
status: experimental
description: Detects rapid enumeration of network shares and directory listings via command-line tools, a reconnaissance pattern observed before actors identify and stage high-value data for theft.
references:
  - https://attack.mitre.org/techniques/T1135/
  - https://attack.mitre.org/techniques/T1083/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1135
  - attack.t1083
logsource:
  category: process_creation
  product: windows
detection:
  selection_net:
    Image|endswith: '\net.exe'
    CommandLine|contains:
      - ' view'
      - ' share'
  selection_sharphound:
    CommandLine|contains:
      - '-c all'
      - '--collectionmethod'
      - 'invoke-bloodhound'
  condition: 1 of selection_*
falsepositives:
  - Systems administrators auditing share permissions — correlate with known admin accounts and change windows
level: medium

KQL — Microsoft Sentinel / Defender Hunt

This query hunts for the exfiltration phase itself: processes associated with bulk transfer tooling executing alongside anomalous outbound network volume, plus archive staging on servers. Run it over a 7-14 day window — extortion actors frequently exfiltrate slowly over days to evade volumetric alerts.

// Hunt: Exfiltration tooling execution and anomalous outbound transfer from servers
// Coverage: rclone/MEGAcmd/WinSCP execution + high-volume outbound from non-workstation devices
let exfil_tools = dynamic(["rclone.exe", "megacmd.exe", "mega-cmd.exe", "winscp.exe", "filezilla.exe", "pscp.exe", "curl.exe"]);
let archive_tools = dynamic(["7z.exe", "7za.exe", "rar.exe", "winrar.exe"]);
let tool_exec = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (exfil_tools)
| where InitiatingProcessAccountName !in~ ("system", "network service", "local service")
| project ToolHost = DeviceName, ToolUser = InitiatingProcessAccountName, ToolCmd = ProcessCommandLine, ToolTime = TimeGenerated, FileName;
let staging = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (archive_tools)
| where ProcessCommandLine has_any (" -p", " -r", " -v", " a ")
| project StageHost = DeviceName, StageUser = InitiatingProcessAccountName, StageCmd = ProcessCommandLine, StageTime = TimeGenerated;
let outbound = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIPType == "Public"
| where RemotePort in (443, 22, 21, 990, 8080)
| summarize TotalConnections = count(), DistinctRemoteIPs = dcount(RemoteIP), RemoteHosts = make_set(RemoteUrl, 20) by DeviceName, bin(TimeGenerated, 1d)
| where TotalConnections > 5000 or DistinctRemoteIPs > 50;
tool_exec
| join kind=outerfull (staging) on $left.ToolHost == $right.StageHost
| join kind=outerfull (outbound) on $left.ToolHost == $right.DeviceName
| project ToolTime, ToolHost, ToolUser, ToolCmd, StageTime, StageCmd, TotalConnections, DistinctRemoteIPs, RemoteHosts
| sort by ToolTime desc

Analyst note: treat any host appearing in both tool_exec and outbound that is not a known backup or file-transfer server as a priority-one investigation. Cross-reference the user account against your admin allowlist and check whether the account authenticated from an unusual source in the preceding 72 hours.

Velociraptor VQL — Endpoint Hunt

Deploy this as a hunt across your server fleet and any device hosting sensitive data. It identifies exfiltration tooling on disk, recent large archive files in common staging locations, and active outbound connections from suspicious processes.

-- Hunt: ExfilSquad-style staging and exfiltration artifacts
-- Identifies transfer tool binaries, large recent archives in staging paths, and
-- outbound connections from non-standard processes

LET binaries = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/*/rclone.exe',
  'C:/Users/*/Downloads/*.exe',
  'C:/ProgramData/**/rclone.exe',
  'C:/ProgramData/**/winscp.exe',
  'C:/ProgramData/**/megacmd.exe',
  'C:/Windows/Temp/*.exe',
  'C:/Temp/*.exe'
])
WHERE FullPath =~ '(?i)(rclone|winscp|megacmd|mega-cmd|pscp|filezilla)'

LET archives = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/Public/**/*.7z',
  'C:/Users/Public/**/*.rar',
  'C:/Users/Public/**/*.zip',
  'C:/ProgramData/**/*.7z',
  'C:/ProgramData/**/*.rar',
  'C:/Windows/Temp/**/*.7z',
  'C:/Windows/Temp/**/*.rar',
  'D:/**/*.7z',
  'D:/**/*.rar'
])
WHERE Size > 100000000
  AND Mtime > (now() - 1209600)

LET connections = SELECT Pid, Name, Path, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND RemotePort in (22, 21, 443, 990, 8080, 8443)
  AND NOT Path =~ '(?i)(program files|windows\\\\system32\\\\svchost|msedge|chrome|firefox)'

SELECT * FROM binaries
UNION ALL
SELECT FullPath, Size, Mtime, NULL AS Pid, NULL AS Name, NULL AS Path, NULL AS RemoteAddr, NULL AS RemotePort, NULL AS Status FROM archives

For fleet-wide hunts, split the three sources into separate artifacts (binaries, archives, connections) so results are easier to triage — the UNION above is for quick single-host checks during active IR.

Remediation / Hardening Script

The script below verifies whether exfiltration-associated tooling exists on a Windows host, enumerates recent large archives in common staging directories, and audits outbound-capable processes. It is a triage and hardening-verification tool — run it via your RMM or GPO startup script across servers, or interactively during IR.

# ExfilSquad-Style Exfiltration Triage & Hardening Verification
# Run elevated. Outputs findings to C:\IR-Triage\exfil-triage-<hostname>-<date>.txt

$outDir = "C:\IR-Triage"
New-Item -ItemType Directory -Path $outDir -Force | Out-Null
$report = Join-Path $outDir ("exfil-triage-" + $env:COMPUTERNAME + "-" + (Get-Date -Format 'yyyyMMdd') + ".txt")

"=== EXFILTRATION TOOL PRESENCE CHECK ===" | Out-File $report
$toolNames = @('rclone.exe','megacmd.exe','mega-cmd.exe','winscp.exe','pscp.exe','filezilla.exe')
foreach ($tool in $toolNames) {
    Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Windows\Temp','C:\Temp' -Recurse -Filter $tool -ErrorAction SilentlyContinue |
        Select-Object FullName, Length, LastWriteTime | Out-File $report -Append
}

"=== LARGE RECENT ARCHIVES (last 14 days, >100MB) ===" | Out-File $report -Append
$cutoff = (Get-Date).AddDays(-14)
Get-ChildItem -Path 'C:\Users\Public','C:\ProgramData','C:\Windows\Temp' -Recurse -Include *.7z,*.rar,*.zip -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -gt 100MB -and $_.LastWriteTime -gt $cutoff } |
    Select-Object FullName, @{N='SizeMB';E={[math]::Round($_.Length/1MB)}}, LastWriteTime | Out-File $report -Append

"=== ESTABLISHED OUTBOUND CONNECTIONS FROM NON-STANDARD PROCESSES ===" | Out-File $report -Append
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 21,22,443,990,8080,8443 -and $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)' } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{ Process=$proc.ProcessName; Path=$proc.Path; Remote=$_.RemoteAddress; Port=$_.RemotePort }
    } | Where-Object { $_.Path -notmatch 'Program Files|system32' } | Out-File $report -Append

"=== INTERNET-FACING REMOTE ACCESS / MFA GAP CHECK ===" | Out-File $report -Append
# Verify RDP NLA is enforced (basic hardening baseline)
$rdpNLA = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
"RDP NLA Enabled (1=yes, 0=NO - REMEDIATE): $rdpNLA" | Out-File $report -Append
# Disable RDP entirely on servers that do not require it (uncomment to enforce):
# Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 1

"=== AUDIT POLICY: VERBOSE PROCESS COMMAND LINE LOGGING ===" | Out-File $report -Append
$cmdAudit = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue).ProcessCreationIncludeCmdLine_Enabled
"CommandLine in 4688 events (1=enabled, required for detections above): $cmdAudit" | Out-File $report -Append
if ($cmdAudit -ne 1) {
    Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -Value 1
    "REMEDIATED: Process command-line auditing now enabled" | Out-File $report -Append
}

Write-Host "Triage complete: $report"

Remediation and Defensive Priorities

There is no patch for this threat class — remediation is architectural and operational. Prioritize in this order:

1. Close the Initial Access Door

• MFA on every remote access path: VPN, RDP gateways, VDI, SaaS admin portals, and especially backup consoles. Thirteen victims strongly suggests repeatable access via weak or absent MFA. Phishing-resistant MFA (FIDO2) for admin and remote access accounts.
• Patch edge devices and file transfer platforms aggressively — these are the highest-value initial access targets for extortion crews. Subscribe to vendor advisories for your VPN, firewall, and managed file transfer stack and treat their critical CVEs as emergency changes.
• Audit for unauthorized RMM tooling: inventory every remote management binary in the environment; block all but your sanctioned platform via application control (WDAC/AppLocker).

2. Detect the Exfiltration Phase — Your Last Real Chance

• Egress filtering and DLP on server VLANs: servers should not be able to initiate arbitrary outbound connections to consumer cloud storage (Mega, Backblaze personal, etc.). Allowlist required destinations; alert on the rest.
• Volumetric + behavioral egress alerting: don't rely solely on volume thresholds — actors exfiltrate slowly. Baseline per-host daily egress and alert on statistical deviation, plus the tool-execution detections above.
• Restrict archive tooling on servers: application control policies that prevent 7-Zip/WinRAR execution outside approved backup software contexts eliminate the noisiest staging method.
• Deploy the Sigma/KQL detections above and validate them with purple-team simulation of staging and exfiltration behaviors.

3. Limit the Blast Radius of Theft

• Data inventory and minimization: you cannot extort data that doesn't exist. Purge stale PII/PHI/financial data beyond retention requirements. Know exactly which shares and databases hold extortion-grade data.
• Encryption at rest with segmented key management reduces the value of stolen datasets in some regulatory contexts, but treat it as a compliance control, not a leak-prevention control.
• SharePoint/OneDrive/Share auditing: enable and centralize unified audit log; alert on bulk download patterns (e.g., thousands of file downloads by a single account in hours).

4. Prepare for the Extortion Event Itself

• Pre-negotiated IR retainer, breach counsel, and cyber insurance carrier contacts — you will need all three within 24 hours of an extortion demand. Retainer activation time is a real metric; test it.
• Tabletop the data-leak scenario: most ransomware tabletops focus on encryption and restoration. Run one where nothing is encrypted and the actor emails proof-of-theft with a 72-hour deadline and a torrent threat. Decision-making around payment, notification timing (state AG deadlines, HIPAA 60-day, PCI obligations), and law enforcement engagement (FBI/CISA reporting) is completely different.
• Dark web and leak-site monitoring: monitor for your organization's name, executive names, and data fingerprints on extortion leak sites and torrent indexes. Early detection of a listing — even before victim notification — compresses your response timeline enormously.
• Regulatory exposure assessment: if you hold HIPAA, PCI-DSS, or state-regulated PII, confirmed exfiltration of that data triggers notification obligations regardless of whether you pay. Map your obligations now, not during the incident.

The ExfilSquad case is a reminder that the extortion economy has decoupled from ransomware deployment. Your EDR can be perfectly tuned for encryption behavior and completely blind to a quiet rclone job running for three weeks. If your detection program cannot answer the question "what left this network in the last 30 days, and where did it go?" — that is the gap to close this quarter.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub