Threat actor
ExfilSquad
Also tracked as Storm-3189
Tracked by CyberSIXT since 27 Jul · RSS
Activity
7 articles from 4 outlets since 27 Jul; the latest 75 days ago.
- Fri 14 Aug. Infosecurity. ExfilSquad leaks 27M records via misconfigured Power Pages.
- Tue 11 Aug. Security Affairs. ExfilSquad Targets New Victims, Shares Data via Torrents.
- Mon 10 Aug. Research report by SOCRadar. Dark Web Profile: ExfilSquad.
- Tue 4 Aug. Infosecurity. Police database leak reveals officers' personal data on dark web.
- Mon 3 Aug. DataBreaches. ExfilSquad Exposes 100k Police Records via UK Government Portals.
- Thu 30 Jul. Security Affairs. Analog Devices says files exfiltrated in June 2026 breach.
- Thu 30 Jul. SecurityWeek. Analog Devices breach sparks extortion claims, no leak evidence.
- Mon 27 Jul. DataBreaches. Frontier Airlines faces third breach as security flaws linger.
- Article naming ExfilSquad
- Square: research report
- Articles a day, all coverage
- Quiet time, folded
Drawn: all 7 articles and the only research report.
Show as tableHide table
| Date | Type | Source | Title |
|---|---|---|---|
| 14 Aug | Article | Infosecurity | ExfilSquad leaks 27M records via misconfigured Power Pages |
| 11 Aug | Article | Security Affairs | ExfilSquad Targets New Victims, Shares Data via Torrents |
| 10 Aug | Report | SOCRadar | Dark Web Profile: ExfilSquad |
| 4 Aug | Article | Infosecurity | Police database leak reveals officers' personal data on dark web |
| 3 Aug | Article | DataBreaches | ExfilSquad Exposes 100k Police Records via UK Government Portals |
| 30 Jul | Article | Security Affairs | Analog Devices says files exfiltrated in June 2026 breach |
| 30 Jul | Article | SecurityWeek | Analog Devices breach sparks extortion claims, no leak evidence |
| 27 Jul | Article | DataBreaches | Frontier Airlines faces third breach as security flaws linger |
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
Microsoft tracks ExfilSquad as Storm-31892. Infosecurity described ExfilSquad as a data extortion group that emerged in July 20261.
Infosecurity reported that researchers confirmed data exfiltration from at least 13 organizations, including government and education, and believed access came through misconfigured Microsoft D365 CRM and ERP instances, specifically Power Pages1. Infosecurity also reported that ExfilSquad claimed responsibility for the Police National Legal Database breach and possession of 1.9GB of data3. Security Affairs reported that Analog Devices was reviewing a separate incident linked to ExfilSquad claims, while SecurityWeek said the claims may be exaggerated4,5.
- ExfilSquad leaks 27M records via misconfigured Power Pages · Infosecurity · 2026-08-14
- ExfilSquad: alias · Microsoft
- Police database leak reveals officers' personal data on dark web · Infosecurity · 2026-08-04
- Analog Devices says files exfiltrated in June 2026 breach · Security Affairs · 2026-07-30
- Analog Devices breach sparks extortion claims, no leak evidence · SecurityWeek · 2026-07-30
CVEs exploited
No CVE is attributed to ExfilSquad in CyberSIXT coverage.
MITRE ATT&CK techniques
No MITRE ATT&CK® techniques are recorded for ExfilSquad.
Articles7
Drawn: all 7 articles and the only research report.
- ExfilSquad Targets New Victims, Shares Data via TorrentsSecurity Affairs
- Analog Devices says files exfiltrated in June 2026 breachSecurity Affairs