rift.cysentrix
← Back to actors

Threat actor

Exfilsquad

34 observed events

AIExfilSquad has been observed engaging in ransomware attacks, targeting sectors including Government & Defense, Technology, Education, Financial Services, Manufacturing, Transportation, and Retail & E-Commerce. The observed events involve victims in the US, GB, SE, and NG.

Activity type

Ransomware
34

Verification

Claim
34

Top sectors

Government & Defense
4
Technology
3
Education
2
Financial Services
2
Manufacturing
2

Top countries

US
10
GB
3
NG
1
SE
1

Observed events

Claim High Ransomware

Bonava

AIExfilsquad listed Bonava on its extortion site, claiming a data breach. The claim

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

City of Atlanta (atlantaga.gov)

AIExfilsquad claims to have compromised the City of Atlanta (atlantaga.gov), per an unverified extortion listing on RansomLook.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

City of Houston (houstontx.gov)

AIExfilsquad claims to have listed City of Houston (houstontx.gov) on their extortion site. This claim is unverified.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Viavi Solutions

AIExfilsquad claims to have listed Viavi Solutions on its extortion site. The claim is unverified.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Newcastle University (ncl.ac.uk)

AIExfilsquad has listed Newcastle University on its extortion site, claiming a breach. This claim is unverified.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

District of Columbia Public Schools (dcps.dc.gov)

AIExfilsquad claims to have posted data from District of Columbia Public Schools (dcps.dc.gov) on its extortion site, but the claim is unverified.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Zenith Bank Plc

AIExfilsquad claims to have listed Zenith Bank Plc on RansomLook in an unverified extortion claim.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Frontier Airlines

AIExfilsquad listed Frontier Airlines on its extortion site, claiming an unverified breach.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

TaylorMade & Sun Day Red golf

AIExfilsquad claims to have listed TaylorMade & Sun Day Red golf on their extortion site.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Allstate

AIExfilsquad claims to have listed Allstate on its extortion site; this is an unverified claim.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Police National Legal Database

AIExfilsquad claims to have listed the Police National Legal Database on their extortion site, per RansomLook; this is an unverified claim.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

UK Department for Education (education.gov.uk)

AIExfilsquad claims to have breached the UK Department for Education, according to an unverified listing on RansomLook.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Wesco International

AIExfilsquad listed Wesco International on RansomLook extortion site, claiming to have exfiltrated data.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Microsoft

AIExfilsquad claims to have listed Microsoft on the RansomLook extortion site. This claim is unverified.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Wesco International

AIExfilSquad has listed Wesco International, a manufacturing company, on its extortion site, claiming to have breached the organization.

Actor ExfilSquad 1 source
Records Undisclosed
Claim High Ransomware

UK Department for Education (education.gov.uk)

COUNTRY : GB REVENUE : NA SIZE : 440 MB UNCOMPRESSED ======================================== DATA SUMMARY: Help Portal (~600K records) – Parent and staff contact records containing full names, email addresses, phone numbers, and job titles. Turing Portal (…

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

District of Columbia Public Schools (dcps.dc.gov)

COUNTRY : US REVENUE : NA SIZE : NA ======================================== WARNING: You would not want us to publicly disclose what we took from your systems. Contact us before 2026-08-05.

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Newcastle University (ncl.ac.uk)

COUNTRY : GB REVENUE : NA SIZE : 240 MB UNCOMPRESSED ======================================== WARNING: You have until 2026-08-05 to contact us DATA SUMMARY: 440K~ records containing: applicant and student contact information, significant PII, and admissions…

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

City of Houston (houstontx.gov)

COUNTRY : US REVENUE : NA SIZE : 71 GB UNCOMPRESSED ======================================== WARNING: You have until 2026-08-05 to contact us. DATA SUMMARY: 6M~ records containing: significant PII, resident contact details, service requests, complaint descr…

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

City of Atlanta (atlantaga.gov)

COUNTRY : US REVENUE : NA SIZE : 36.3 GB UNCOMPRESSED ======================================== WARNING: You have until 2026-08-05 to contact us. DATA SUMMARY: 3M~ records containing: significant PII, citizen service requests, addresses, municipal case histo…

Actor Exfilsquad 1 source
Records Undisclosed
Claim High Ransomware

Analog Devices

AIExfilSquad claims to have breached technology firm Analog Devices, according to an unverified listing on Ransomware.live.

Actor ExfilSquad 2 sources
Records Undisclosed
Claim High Ransomware

Bonava

AIExfilSquad listed Bonava, a manufacturer, on its extortion site as claiming a breach, per Ransomware.live.

Actor ExfilSquad 2 sources
Records Undisclosed
Claim High Ransomware

City of Atlanta

AIExfilSquad claims to have breached the City of Atlanta. The extortion listing appears on Ransomware.live.

Actor ExfilSquad 1 source
Records Undisclosed
Claim High Ransomware

City of Houston

AIExfilSquad claims to have breached the City of Houston, according to an unverified ransomware extortion site listing.

Actor ExfilSquad 1 source
Records Undisclosed
Claim High Ransomware

Viavi Solutions

AIExfilSquad claims to have breached Viavi Solutions (Technology) in an unverified listing on Ransomware.live.

Actor ExfilSquad 2 sources
Records Undisclosed
Claim High Ransomware

Newcastle University

AIExfilSquad claims to have breached Newcastle University and listed it on their extortion site.

Actor ExfilSquad 1 source
Records Undisclosed
Claim High Ransomware

District of Columbia Public Schools

AIExfilSquad claims to have breached District of Columbia Public Schools, per a listing on Ransomware.live. The claim is unverified.

Actor ExfilSquad 1 source
Records Undisclosed
Claim High Ransomware

Zenith Bank Plc

AIExfilSquad claims to have breached Zenith Bank Plc, a financial services firm, as listed on their extortion site.

Actor ExfilSquad 2 sources
Records Undisclosed
Claim High Ransomware

Frontier Airlines

AIExfilSquad has listed Frontier Airlines on its extortion site, claiming to have breached the transportation company.

Actor ExfilSquad 2 sources
Records Undisclosed
Claim High Ransomware

TaylorMade & Sun Day Red golf

AIExfilSquad claims to have listed TaylorMade & Sun Day Red golf in an unverified extortion threat on Ransomware.live.

Actor ExfilSquad 2 sources
Records Undisclosed
Claim High Ransomware

Allstate

AIExfilSquad claims to have breached Allstate, a financial services firm, according to a listing on Ransomware.live.

Actor ExfilSquad 2 sources
Records Undisclosed
Claim High Ransomware

Microsoft

AIExfilSquad listed Microsoft on its extortion site, making an unverified claim of a breach.

Actor ExfilSquad 2 sources
Records Undisclosed
Claim High Ransomware

Police National Legal Database

AIExfilSquad claims to have data from the Police National Legal Database (Government & Defense) in an unverified extortion listing on Ransomware.live.

Actor ExfilSquad 2 sources
Records Undisclosed
Claim High Ransomware

UK Department for Education

AIExfilSquad claims to have compromised the UK Department for Education, per a Ransomware.live extortion site listing.

Actor ExfilSquad 1 source
Records Undisclosed