ExfilSquad’s Claims Check Out

New research from Fortra’s Intelligence and Research Experts (FIRE) has confirmed that the ExfilSquad data extortion group really did get its hands on sensitive data. The criminals claimed they had exfiltrated information from 15 organizations. Now, the evidence shows they weren’t bluffing.

FIRE reviewed the public data samples and concluded that the group’s access to sensitive data is real. At least 13 victims have been hit, spanning government, education, financial services, and manufacturing. That’s not a small-time operation.

The group first surfaced on July 26. By August 7, they had published data dumps for 13 of the 15 claimed victims via torrents, saying those organizations didn’t meet their demands. The full archive, named “[victim]_exfilsquad,” was up for download. The total haul? A staggering 382.64 GB and 27 million records.

Who Got Hit?

The victim list reads like a cross-section of public and private sectors. The City of Atlanta (atlantaga.gov), the UK Department for Education (education.gov.uk), and the UK Police National Legal Database all appear. The District of Columbia Public Schools (DCPS) is also on the list.

For DCPS, the attackers took an unusual stance. They wrote: “We are not going to dox a bunch of school children, but we are going to expose how incompetent DCPS is at keeping children as young as six’s information safe. Thus, we are releasing a censored version of the leak and have shredded the original entirely from our servers.”

In that case, 60,000 records were leaked, containing student names, dates of birth, and unique student identifiers—classic personally identifiable information (PII).

Notably, Zenith Bank Plc and Analog Devices were on the original 15-victim list but didn’t appear in the dumps. The FIRE team flagged this as a possible sign that those negotiations went differently, or the data wasn’t ready to be released.

The Likely Attack Vector: Misconfigured Microsoft Power Pages

So how did ExfilSquad pull this off? Fortra’s researchers believe the breaches stem from unauthorized access to Microsoft D365 CRM and ERP instances. The leading theory? Misconfigured Microsoft Power Page portals that allowed public read access.

Power Pages is a SaaS platform for building external-facing business websites. If set up wrong, it can expose data to anyone who knows where to look. The leaked data formations matched Microsoft Dataverse exports, which suggests unauthorized read access was achieved during the incidents.

The attackers probably found their targets by crawling for misconfigured Power Portals or using other enumeration techniques. It wasn’t a sophisticated zero-day exploit. It was a configuration error—and that’s what makes it so dangerous.

Why It’s Not a D365 Vulnerability

Fortra was quick to note that because the breach hit only 15 victims, not tens of thousands, a systemic vulnerability in D365 is unlikely. Instead, the issue is specific to how Power Pages is configured.

There’s a known problem: when the Anonymous Users web role is assigned to a table permission, anyone visiting the site can read the table’s data. Power Pages can be accessed via an API at https://<portal>/_api/*. Microsoft’s own documentation advises against using this role in publicly exposed sites, but not everyone follows the guidance.

Fortra’s research even found over 10,000 potential Power Pages instances accessible to the public. That’s a lot of attack surface.

What This Means for Organizations

This incident is a wake-up call. Data extortion groups like ExfilSquad are actively scanning for misconfigured systems. They don’t need to break in—they just need a door left open.

For any organization using Microsoft Power Pages or D365, the takeaway is clear: audit your table permissions, disable Anonymous Users roles on public sites, and monitor API access. A few minutes of configuration review could save you from a 382 GB leak.

If you’re dealing with a similar threat, understanding the data extortion group tactics can help you prepare. And if you’re using Microsoft Power Pages security settings, double-check them now.

The ExfilSquad data leak is a reminder that cybercriminals are patient and methodical. They find the weak spots, and they exploit them. Don’t be the next headline.

The Numbers Behind the Credential Gold Rush

The scale of the credential theft problem just got a lot clearer. New data from Flashpoint shows infostealer malware compromised 7.4 million devices in the first half of 2026. That is a 27% jump from the previous six-month window.

Think about what that means in practice. Each infected machine is a potential pipeline into corporate networks, personal accounts, and cloud infrastructure. The total haul? A staggering 1.7 billion credentials harvested between January and June alone.

The findings come from the company’s 2026 Global Threat Intelligence Report: Midyear Edition, which pulls data from deep web forums, illicit marketplaces, encrypted channels, and threat actor infrastructure.

Vidar, StealC, and Lumma Lead the Pack

Not all infostealers are created equal. Flashpoint identified three variants doing the heavy lifting: Vidar, StealC, and Lumma. These three families account for the bulk of the stolen credential volume.

What makes them so effective? Automation. The report describes a landscape that has morphed into a fully automated threat ecosystem.

“These systems do not require constant human oversight; instead, they function as autonomous credential processing engines capable of ingestion and orchestration at machine speed,” the report states. “This evolution redefines the lifecycle of a breach.”

The implications are sobering. Once an infostealer family harvests data, the systems immediately ingest the records, parse out high-value metadata, and kick off parallel credential stuffing and active session testing across thousands of environments. Human involvement is almost an afterthought.

The Vulnerability Picture: More Disclosures, Fewer Exploits

Credentials are only part of the story. Flashpoint also tracked 21,667 vulnerability disclosures over the period, an 8% increase from the previous six months. Nearly one in five flaws (19%) shipped with public or functional exploit code.

Here is where the data gets interesting. Despite the high volume of disclosures, only a fraction saw real-world exploitation. Flashpoint’s Known Exploited Vulnerabilities (KEV) catalog logged 239 flaws under active, in-the-wild exploitation during H1 2026.

That figure is 191% higher than the 82 flaws on the federal CISA KEV list. The vendor also claims it isolated 6,808 vulnerabilities for its customers before the National Vulnerability Database (NVD) even published them.

The Patch Race Is Getting Faster

The gap between disclosure and exploitation is narrowing. Attackers are weaponizing known flaws at machine speed, which puts pressure on defenders to prioritize based on actual threat intelligence rather than CVSS scores alone.

Malicious AI Activity Surges on Underground Channels

The underground economy is being reshaped by AI, and the numbers are hard to ignore. Flashpoint captured over 22 million posts related to malicious AI use on illicit forums and closed-chat channels.

Many threat actors are now deploying AI tooling locally, thanks to commoditized access to open-source models. They no longer need to rely on public underground networks or specialized deployment services.

But for those who still need external services, the report points to a specific set of platforms. “Cybercrime-trained AI offerings remain overwhelmingly concentrated within rapid-delivery messaging platforms and open-source infrastructure,” the report notes. “These platforms, such as Telegram, are commonly utilized by illicit communities, followed by Reddit, GitHub, and Pastebin.”

These channels have effectively become a distribution layer for malware, social engineering scripts, and other attack tooling.

Ransomware Victims Up 45% — But Payouts Are Down

Ransomware activity continues to climb. Flashpoint counted 6,256 victims in the first six months of 2026, a 45% increase from the prior period. The growth is driven by automation, low-cost initial access, and a mature ransomware-as-a-service (RaaS) ecosystem.

Yet there is a counter-trend worth noting. Fewer organizations are paying the extortion demands. This mirrors broader industry observations that victims are increasingly refusing to negotiate, opting for backups and incident response instead.

The tension between rising victim counts and falling payout rates suggests the ransomware model is under pressure, even as it scales.

What This Means for Defenders

The takeaway from Flashpoint’s midyear data is clear: identity is now the primary attack surface. Infostealers are the entry point, and the automation behind them means credential stuffing campaigns can run at a scale that manual efforts could never match.

For organizations, the practical response involves a few priorities:

• Deploying robust multi-factor authentication to blunt the impact of stolen credentials
• Monitoring for session cookie theft, which bypasses traditional MFA protections
• Prioritizing patch management based on real-world exploit activity, not just severity scores
• Watching for AI-generated phishing and social engineering content on platforms like Telegram and Reddit

The infostealer ecosystem has industrialized. The question is whether enterprise defenses can keep pace with machines that never sleep.

Two ransomware cases hit major milestones in U.S. courts

Federal prosecutors are closing in on the people who built and ran some of the most damaging ransomware operations of the past decade. This week brought two significant developments: a Ryuk operator pleaded guilty in Oregon, and a Florida man who helped the Blackcat/AlphV gang got a 70-month prison sentence.

Karen Serobovich Vardanyan, a 34-year-old Armenian national, admitted to conspiracy and computer fraud charges on Wednesday. For about six months starting in November 2019, he broke into corporate networks to deploy Ryuk ransomware, according to prosecutors.

Separately, Angelo Martino, 41, of Land O’Lakes, Florida, was sentenced to 70 months in federal prison for aiding Blackcat/AlphV extortion efforts beginning in April 2023. Martino’s case stands out because he used his day job as a ransomware negotiator to help the criminals squeeze more money out of victims.

Vardanyan’s Ryuk attacks: a Michigan company paid 200 bitcoin

Vardanyan was extradited from Ukraine to the U.S. in June 2025, after his arrest in Kyiv two months earlier. He now faces up to 15 years in prison and fines up to $500,000. He has also agreed to pay more than $1.1 million in restitution. His sentencing is set for September 22.

Prosecutors detailed some of his alleged attacks. “Vardanyan worked with his co-conspirators to attack a company in Michigan that paid 200 bitcoin or over $1.1 million at the time of payment to restore access to their network,” they said. “They also attacked a company in Wilsonville, Oregon, and in February 2020 attacked a school in Texas.”

Ryuk first appeared in August 2018, targeting large organizations with enormous ransom demands. Law enforcement and cybersecurity researchers have tied it to other major cybercrime operations, including Conti and Trickbot. International authorities have pursued Ryuk for years, successfully prosecuting one of its money launderers and sanctioning other alleged members.

Other Ryuk defendants still being pursued

Vardanyan’s case is part of a broader crackdown. Armenian national Levon Georgiyovych Avetisyan faces conspiracy, fraud, and extortion charges. Ukrainian nationals Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko face the same charges. Prosecutors said last year that Avetisyan was in custody in France, while the two Ukrainians remained at large.

The U.S. Department of Justice has been steadily dismantling the Ryuk ecosystem, which also overlaps with the Trickbot botnet infrastructure. Each guilty plea and arrest chips away at the network’s ability to operate.

Martino: the negotiator who turned against his own clients

Martino surrendered to U.S. Marshals in March and pleaded guilty in April to an extortion charge. His story is a cautionary tale about trust in the cybersecurity industry.

Prosecutors said Martino “was paid by BlackCat attackers to provide confidential information about the negotiating position and strategy of his employer’s clients and enable the ransomware actors to maximize the ransoms paid by the victims.” In other words, he was double-dealing — collecting a salary from a legitimate firm while secretly working for the criminals on the other side of the negotiation table.

Two other men connected to the same case, Ryan Goldberg and Kevin Martin, pleaded guilty to extortion charges earlier this year. Both received four-year prison sentences in May. Martin and Martino were ransomware negotiators for DigitalMint, while Goldberg worked for incident response firm Sygnia.

DigitalMint has since implemented new controls requiring all negotiations to be conducted over cloud-based platforms that can be audited and logged. One of the company’s founders is personally overseeing all negotiations now.

What this means for ransomware enforcement

These cases show that law enforcement is willing to pursue not just the hackers who deploy ransomware, but also the people who enable them — even when those people hold legitimate jobs in the cybersecurity industry. The Martino case, in particular, sends a message to negotiators and incident responders: if you cross the line, you’ll face serious consequences.

For ransomware victims and negotiators, the takeaway is clear. Verify who you’re working with. Check backgrounds. And be aware that the person helping you negotiate could be feeding information to the attackers.

Both cases also highlight the international scope of ransomware investigations. Vardanyan was arrested in Ukraine and extradited to the U.S. Avetisyan is in French custody. The Justice Department is coordinating with allies to chase these suspects across borders.

Sentencing for Vardanyan is scheduled for September 22. Martino’s 70-month sentence is already in place. The fallout from these cases will likely continue as prosecutors pursue the remaining defendants.