Threat Intelligence Report April 14 - April 20 2026

Exitium Ransomware

Exitium is a new, small-volume but data-centric extortion group that emerged on dark-web leak trackers in mid-March 2026 and, during the week under review, publicly claimed one new US healthcare victim - Gastroenterology & Hepatology of CNY, alongside a very large patient-record dataset (167,303 patients, including ~124,000 SSNs). Exitium operates as a double-extortion / “data broker” outfit rather than a disciplined encryption-first crew: only one of its five named victims to date has been described as fully encrypted.

Background and General Description

Origin and First Observation

Exitium first surfaced on public ransomware trackers on 12 March 2026, when FalconFeeds.io announced it was monitoring a new ransomware group named Exitium with two initial victims listed on its Tor portal. Ransomware.live and ransomlook.io subsequently indexed the group, recording a first-discovery date of 17 March 2026 and classifying Exitium as an active data-broker/double-extortion operator. No predecessor, successor, rebrand lineage, or attribution to a known nation-state or established financially motivated syndicate has been reported. No RaaS affiliate program structure has been publicly observed, and no affiliate recruitment posts were identified during the reporting window.

The ransom note - filename YOU ARE UNDER ATTACK.html (alternately rendered YOU ARE UNDER ATTACK!.html) - demands contact within 168 hours (7 days) via Tox, with explicit instruction to download the qTox client from the legitimate GitHub release URL and send a friend request to the group's Tox ID. The note warns against contacting law enforcement, promises data deletion on payment, and declares the group is “not hacktivists and not politically motivated.” RedPacket Security carries a verification banner on every Exitium listing stating the group's victim claims have been reported as including unverified or fabricated victim claims - SOC analysts should therefore treat unconfirmed listings with healthy skepticism until independent evidence (victim notification, dataset release, SEC 8-K) corroborates the compromise.

Tactics, Techniques, and Procedures (TTPs)

Critical Caveat

No independent malware analysis of an Exitium sample has been published by any major vendor (Sophos, SentinelOne, Mandiant, Unit 42, Trend Micro, Kaspersky, ESET, Cybereason, Bitdefender, Microsoft, Cisco Talos, Recorded Future, Intel471, Flashpoint). No public sandbox report exists on ANY.RUN, Tria.ge, or Hybrid-Analysis for a sample tagged “Exitium.” Ransomware.live's own group profile explicitly states that no YARA rules, tools, vulnerabilities, TTPs, or negotiation chats are available for Exitium. Consequently, the TTP table below lists only behaviours directly observed in the ransom note, leak-site posts, or removal-guide writeups. Every entry that cannot be sourced is marked “not publicly available” - none have been inferred.

Analytic Takeaway

Exitium should be treated as a pre-ransom data-exfil actor first, encryptor second. The one confirmed encryption event (Ming Hwei Energy) is the exception; the pattern elsewhere is quiet bulk theft followed by Tor-based naming-and-shaming. Detection investment should therefore skew toward egress anomaly detection, DLP, identity monitoring, and VPN-edge hardening - not solely toward endpoint ransom-note heuristics.

Indicators of Compromise (IOCs)

All IOCs below are verified across at least two independent public sources unless a single-source caveat is noted. Items for which no public IOC exists are listed explicitly as "not publicly available" to prevent speculative blocking.

Infrastructure and Contact IOCs

Host Artefacts

Ransom Note

Crystal Eye 5.5 Mitigation Strategies

Mapping the confirmed (and reasonably-inferred) TTPs onto Crystal Eye 5.5 modules, following the same control-mapping structure Red Piranha uses in its Kazu, Qilin, and Play ransomware threat briefs. Because Exitium's publicly-documented behaviour is dominated by data theft, Tor-based extortion, and Tox C2, the mitigation weight falls on network egress, DLP, identity, and exposure management rather than endpoint-only ransomware heuristics.

Enable SEG anti-phishing, BEC/impersonation detection, DLP on outbound mail; enforce SPF/DKIM/DMARC reject; detonate attachments; on SWG enable DPI + Anti-malware File Scanner on HTTP/HTTPS; subscribe to DNS.Insure blacklist for malicious-domain blocking at DNS tier.

Enforce MFA on all SSL-VPN/WireGuard/OpenVPN via Entra ID SSO (5.5 feature).

Enable CEASR application allowlisting aligned to ASD Essential Eight Maturity Level 3; block execution from %TEMP%, %APPDATA%, %LOCALAPPDATA%\Downloads; activate EDR pre/during/post-execution AV, exploit protection, and ransomware-specific protection; lock USB/CD device control.