ExfilSquad
ExfilSquad is a ransomware group with a financial motive, tracked by Brandefense. It targets 7 sectors, including Government and Technology, in 4 countries, including the United States and the United Kingdom. It uses 13 MITRE ATT&CK techniques.
- Techniques
- 13
- Exploited CVEs
- No CVE data
- First seen
- Jul 26, 2026
- Last seen
- Jul 26, 2026
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
13 techniques across 8 of 14 tacticsReconnaissance·
Resource Development1
Financial Theft
Initial Access3
Valid Accounts
Exploit Public-Facing Application
Data from Information Repositories
Execution·
Persistence·
Privilege Escalation1
Steal or Forge Authentication Certificates
Defense Evasion1
Multi-Factor Authentication Interception
Credential Access1
Transfer Data to Cloud Account
Discovery·
Lateral Movement·
Command and Control·
Exfiltration3
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol
Exfiltration Over Web Service
Impact1
Data Encrypted for Impact
Arsenal · Malware And Tools.
- Exfilsquadmalware
About ExfilSquad.
ExfilSquad is a ransomware and data-extortion threat actor that employs a double-extortion model, involving both the encryption of victim data and the threat of publicizing exfiltrated sensitive information to pressure organizations into paying ransoms. The group is also identified by several aliases, including PEAR, Clop, D1R, Royal Ransomware, and Agentic JADEPUFFER. The actor's operations are characterized by opportunistic targeting across diverse sectors such as technology, financial services, education, government, transportation, manufacturing, and law enforcement.
Geographically, their activity has been primarily observed in the United States, the United Kingdom, and Nigeria. High-visibility targets claimed by the group include major enterprises and public institutions like Microsoft, Allstate, Frontier Airlines, and the UK Department for Education. In July 2026, ExfilSquad claimed a massive breach of Microsoft, allegedly exfiltrating 130 GB of data containing roughly 8 million records, including personally identifiable information (PII), authentication hashes, and internal corporate documents.
Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.