exitium
Intelligence Profile
Exitium is a data extortion group first observed in early 2026, operating a Tor-based double extortion site and targeting victims via bulk data exfiltration followed by public naming-and-shaming, with known victims including a Brazilian agro-industrial firm and a US county appraisal district.
Threat Analysis
exitium is a ransomware operation that deploys encryption-based extortion against organizations globally. This group maintains a data leak site (DLS) to pressure victims into paying ransom demands.
Financially motivated threat actors like exitium prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Known Campaigns
Exitium is conducting an active ransomware campaign targeting organizations across 3 countries. Primary targets: Agriculture and Food Production, Energy, Public Sector. 8 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 11 Apr 2026).