Actor Profile

🏹 ExfilSquad — Ransomware

Only exfiltration

🔄 Pivot:🌎 US 🏹 ExfilSquad

Classification

Ransomware

Leak-site victims

Ransomware.live

Associated IoCs

local intel

MITRE techniques

—

ATT&CK

Tracked

Yes

Ransomware.live

PIVOT🔍 Advanced Search 🕵 OSINT Pivot 🔗 Link Analysis 🕑 Timeline 📤 Export STIX/MISP

🔥 Leak-Site Victims (15)

Victim	Country	Published	Domain
Newcastle University	GB	2026-07-26T10:24:47.510324+00:00	`ncl.ac.uk`
Wesco International	US	2026-07-26T23:50:39.165392+00:00	`wesco.com`
Bonava	SE	2026-07-26T10:26:05.509472+00:00	`bonava.se`
City of Atlanta	US	2026-07-26T10:25:46.597126+00:00	`atlantaga.gov`
City of Houston	US	2026-07-26T10:25:26.605303+00:00	`houstontx.gov`
Viavi Solutions	US	2026-07-26T10:25:06.535633+00:00	`viavisolutions.com`
District of Columbia Public Schools	US	2026-07-26T10:24:27.530153+00:00	`dcps.dc.gov`
Frontier Airlines	US	2026-07-26T10:23:45.609462+00:00	`flyfrontier.com`
TaylorMade & Sun Day Red golf	US	2026-07-26T10:23:26.744697+00:00	`taylormadegolf.com`
Allstate	US	2026-07-26T10:23:07.482882+00:00	`allstate.com`
Microsoft	US	2026-07-26T10:22:48.693353+00:00	`microsoft.com`
Police National Legal Database	GB	2026-07-26T10:22:29.999838+00:00	—
UK Department for Education	GB	2026-07-26T10:22:11.079582+00:00	`education.gov.uk`
Zenith Bank Plc	NG	2026-07-26T10:24:04.547097+00:00	`zenithbank.com`
Analog Devices	US	2026-07-26T10:26:24.968894+00:00	`analog.com`

Source: Ransomware.live leak-site monitoring (cached, offline-safe).

MITRE ATT&CK Groups ↗ Ransomware.live ↗ APT Theater →

📁 Case Management

Attach to case

Role

+ New case from this

🏹 Campaigns & malware

Campaigns →Malware families →Nation-State theater →Sanctions →Wanted & Rewards →

🏹 Add to case

Attach ExfilSquad (Actor / APT) and pull all linked entities: pull linked

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🧭 Intelligence disciplines

CYBINT →OSINT →HUMINT →GEOINT →

Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook