Actor Profile

ExfilSquad is a data extortion group that specializes in exfiltrating sensitive information from organizations and leveraging it for ransom demands. The group operates a data leak site where they publish stolen data after ransom deadlines expire. ExfilSquad has demonstrated a pattern of targeting improperly configured cloud environments, particularly Microsoft Power Pages data tables, to gain unauthorized access to CRM and database systems. Their motivation appears to be financially driven, using the threat of public data exposure to coerce victims into paying ransoms. The group has established a track record of breaching high-profile organizations across multiple sectors including technology, government, and education.

TTPs (Tactics, Techniques, Procedures)

ExfilSquad's primary attack vector involves exploiting improperly configured Microsoft Power Pages data tables to access cloud-based CRM environments. Research from Resecurity and VenariX indicates the group targets misconfigured data exposure points rather than deploying ransomware or malware. In the Wesco incident, the threat actor gained access to the company's cloud CRM environment (likely Microsoft Dynamics 365) and exfiltrated approximately 2.6 million records. The attack chain appears to focus on T1530 (Data from Cloud Storage Object), T1213 (Data from Information Repositories), and T1567 (Exfiltration Over Web Service). No evidence of ransomware deployment (T1486) or persistent malware was detected, suggesting the group prioritizes stealth and rapid data exfiltration over destructive actions. The group employs T1657 (Financial Theft) through extortion tactics, publishing stolen data on their leak site when ransom demands are not met.

Targets & Patterns

ExfilSquad targets organizations with valuable customer and employee data stored in cloud-based CRM and database systems. Their victim profile includes technology companies (Analog Devices), government entities (U.K. Police National Legal Database), educational institutions (Newcastle University), and supply chain/distribution companies (Wesco). The common thread is organizations using Microsoft cloud services, particularly those with misconfigured Power Pages or Dynamics 365 environments. The group appears to prioritize targets with large datasets containing personally identifiable information (PII), authentication metadata, business identifiers, and contact information that can be monetized through extortion. Supply chain and distribution sectors are attractive targets due to their extensive customer databases and business-critical nature, where data exposure could damage customer relationships and competitive positioning.

Historical Context

ExfilSquad has established a pattern of high-profile breaches targeting cloud infrastructure misconfigurations. Previous campaigns include the breach of Analog Devices (technology sector), the U.K.'s Police National Legal Database (exposing information of over 100,000 UK police officers and staff), and Newcastle University (education sector). These incidents demonstrate the group's consistent focus on data exfiltration rather than ransomware deployment. The Wesco incident follows the same operational playbook: identify misconfigured cloud services, exfiltrate large datasets, issue ransom demands, and publish data on their leak site when demands are not met. Research from Resecurity and VenariX has specifically linked ExfilSquad activity to exploitation of improperly configured Microsoft Power Pages data tables, indicating a specialized technical capability in identifying and exploiting cloud service misconfigurations.

Defensive Recommendations

  • Conduct immediate security audits of Microsoft Power Pages, Dynamics 365, and other cloud CRM configurations to identify and remediate publicly accessible data tables or improperly configured access controls
  • Implement continuous monitoring for unusual data access patterns in cloud CRM environments, particularly large-scale data queries or exports that deviate from normal user behavior (detect T1530 and T1213)
  • Enforce principle of least privilege for CRM access, implement multi-factor authentication for all cloud service accounts, and regularly review authentication logs for suspicious credential usage
  • Deploy Data Loss Prevention (DLP) solutions with cloud-native integrations to detect and block bulk data exfiltration attempts from CRM and database systems (mitigate T1567)
  • Establish baseline monitoring for external data sharing configurations in Microsoft cloud services and alert on any changes to public access settings or anonymous access permissions