EXFILSQUAD Ransomware: Surge in Critical Infrastructure Targeting — 14 New Victims & CVE Exploitation Analysis

Aliases & Operational Model: EXFILSQUAD operates as a highly aggressive Ransomware-as-a-Service (RaaS) entity. While historically quiet, they have recently surged in activity, likely recruiting new affiliates with access to zero-day or freshly disclosed exploits. They strictly utilize a double-extortion model, encrypting systems while threatening to leak sensitive data to pressure victims into payment.

TTPs & Playbook:

• Initial Access: Heavily reliant on external remote services (RDP, VPNs) and exploitation of remote management tools (e.g., ConnectWise ScreenConnect). The recent correlation with CISA KEVs suggests they buy initial access from initial access brokers (IABs) or exploit vulnerabilities themselves within 24-48 hours of disclosure.
• Dwell Time: Short. EXFILSQUAD typically moves laterally within 3–5 days of gaining a foothold, focusing on data exfiltration before triggering encryption.
• Ransom Demands: Variable, scaling significantly based on victim revenue. Recent targets like Microsoft and Allstate suggest demands in the tens of millions.

Current Campaign Analysis

Campaign Overview (2026-07-26): EXFILSQUAD executed a massive "data dump" event on July 26, 2026, posting 14 victims simultaneously. This indicates a synchronized operation likely leveraging a specific exploit kit or a compromised managed service provider (MSP) supply chain.

Sector & Geographic Targeting:

• Sectors: Heavy focus on Government & Defense (4) and Technology (3), followed by Education (2) and Financial Services (2). The targeting of the City of Atlanta, City of Houston, and the UK Department for Education suggests a deliberate intent to disrupt public services and critical infrastructure.
• Geography: Predominantly United States (9), with significant spill-over into the United Kingdom (3). Single incidents in Sweden (Bonava) and Nigeria (Zenith Bank) suggest opportunistic global scanning.

Victim Profile: The victim list includes high-revenue entities (Allstate, Microsoft, Analog Devices) and large municipal bodies. This is a departure from mid-market focus, indicating EXFILSQUAD affiliates are capable of breaching enterprise-grade defenses.

Observed TTPs & CVE Correlation: The recent postings strongly correlate with the exploitation of the following CISA KEVs:

1. CVE-2024-1708 (ConnectWise ScreenConnect): Used extensively to gain remote code execution on IT management consoles.
2. CVE-2026-20131 (Cisco Secure Firewall FMC): Likely used to breach perimeter defenses and pivot into internal networks of government targets.
3. CVE-2026-50751 (Check Point Security Gateway): Another vector for perimeter bypass.

Detection Engineering

Sigma Rules

---
title: Potential ScreenConnect Authentication Bypass (CVE-2024-1708)
id: 6c4c66b0-5c2a-45a6-9c9b-8a1d5b6e7f8a
description: Detects exploitation attempts of the ConnectWise ScreenConnect authentication bypass vulnerability.
status: experimental
date: 2026/07/26
author: Security Arsenal Research
logsource:
  category: web
detection:
  selection:
    cs-uri-query|contains:
      - '/App_Extensions/'
      - 'Services/Authentication.ashx'
  condition: selection
falsepositives:
  - Legitimate administrative access via ScreenConnect
level: critical
---
title: Cisco FMC Deserialization Exploit Activity (CVE-2026-20131)
id: d4e3f2a1-6b5c-4d8e-9f0a-1b2c3d4e5f6a
description: Detects potential exploitation of Cisco FMC deserialization vulnerability via specific API endpoints.
status: experimental
date: 2026/07/26
author: Security Arsenal Research
logsource:
  category: network
detection:
  selection:
    dst_port|startswith: 443
    uri|contains: '/api/fmc_config/v1/domain/'
    http_method: POST
  filter:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Valid API calls from internal management stations
level: high
---
title: Ransomware Lateral Movement via PsExec
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects the use of PsExec for lateral movement, a common EXFILSQUAD TTP.
status: experimental
date: 2026/07/26
author: Security Arsenal Research
logsource:
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\psexec.exe'
      - '\psexec64.exe'
    CommandLine|contains:
      - '-accepteula'
      - '\\'
  condition: selection
falsepositives:
  - Authorized administrative activities
level: high

KQL (Microsoft Sentinel)

// Hunt for potential EXFILSQUAD staging and lateral movement
let ProcessCreation = SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine;
let SuspiciousProcesses = ProcessCreation
| where NewProcessName has "powershell.exe" or NewProcessName has "cmd.exe"
| where CommandLine has "Invoke-Expression" or CommandLine has "EncodedCommand" or CommandLine has "vssadmin.exe";
let NetworkConnection = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (445, 3389, 8080) or InitiatingProcessFileName has "psexec";
union SuspiciousProcesses, NetworkConnection
| summarize count() by Computer, bin(TimeGenerated, 1h)
| where count_ > 5
| sort by count_ desc

PowerShell Response Script

# ExfilSquad Response Check: Identify Scheduled Tasks and VSS Manipulation
Write-Host "[+] Checking for recently created scheduled tasks (Last 7 Days)..."
Get-ScheduledTask | Where-Object {$_.Date -ge (Get-Date).AddDays(-7)} | Select-Object TaskName, Date, Author, Action

Write-Host "[+] Checking for Volume Shadow Copy manipulation attempts..."
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message | Format-List

Write-Host "[+] Enumerating active RDP sessions..."
query session | Select-Object SESSIONNAME, USERNAME, ID, STATE

Write-Host "[+] Checking for common ransomware process extensions..."
Get-Process | Where-Object {$_.ProcessName -match '(lock|bit|zip|enc|crypt|phoenix)'} | Select-Object ProcessName, Id, StartTime


---

Incident Response Priorities

T-Minus Detection Checklist:

1. VPN/RDP Logs: Immediate scrub of logs for successful authentication followed by mass file transfer events. Look for IP ranges associated with Nigeria (NG) and unusual login times for US/GB accounts.
2. ScreenConnect Audit: Check ConnectWiseControl\Services logs for the WebSessionCreated event around 2026-07-25 to 2026-07-26.
3. Cisco/Check Point Logs: Correlate firewall management logs with the creation of new admin users or rule changes preceding the encryption event.

Critical Assets: Historically, EXFILSQUAD targets:

• PII Databases: Student records (Education), Voter rolls (Government).
• Intellectual Property: CAD files (Manufacturing), Source Code (Technology).

Containment Actions (Urgency Order):

1. Isolate: Disconnect VPN concentrators and Cisco FMC appliances from the management network.
2. Disable: Suspend all service accounts used for ScreenConnect/Remote IT management immediately.
3. Revoke: Reset credentials for privileged domain admins found in the EVTX logs of the breached systems.

Hardening Recommendations

Immediate (24 Hours):

• Patch: Deploy patches for CVE-2024-1708 (ConnectWise), CVE-2026-20131 (Cisco FMC), and CVE-2026-50751 (Check Point) immediately.
• Block: Implement network rules to block inbound traffic to known ScreenConnect ports from untrusted IPs.
• MFA: Enforce MFA on all VPN and remote access solutions; push notifications for unusual access.

Short-Term (2 Weeks):

• Network Segmentation: Ensure IT management tools (ScreenConnect, RMM) are on a separate VLAN from the general user network.
• Egress Filtering: Restrict outbound traffic to known cloud storage providers often used for exfiltration (Mega, Dropbox).
• Zero Trust: Move from implicit trust to explicit verification for all firewall management interfaces.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub