Exitium is a cybercrime group active since 2026, known for data theft via double extortion.
Exitium is a cybercrime group first observed in early 2026, focusing on data extortion. The group has targeted entities such as a Brazilian agro-industrial firm and a US county appraisal district. Their primary TTPs involve bulk data exfiltration followed by public naming-and-shaming through a Tor-based double extortion site. Defenders should prioritize monitoring for anomalous large-scale data egress, reinforcing Data Loss Prevention (DLP) solutions, and reviewing response procedures to extortion demands to prevent the public disclosure of breached information.
Exitium is a data extortion group first observed in early 2026, operating a Tor-based double extortion site and targeting victims via bulk data exfiltration followed by public naming-and-shaming, with known victims including a Brazilian agro-industrial firm and a US county appraisal district.
Exitium pressures victims by using a Tor-based double extortion site to publicly name-and-shame them after bulk data exfiltration.
Defenders should prioritize monitoring for anomalous large-scale data egress.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.