Skip to main content
Darkfield

Operator dossier

exitium is a ransomware operator currently active on public leak sites. Darkfield has indexed 10 public victims claimed by this operator between March 17, 2026 and June 4, 2026. Exitium is an emerging ransomware group that was first observed in March 2026, operating with apparent financial motivations based on their limited but documented attack patterns. Given the recent emergence and limited public documentation, specific details about the group's country of origin, organizational structure, or potential affiliations remain unclear to security researchers and law enforcement agencies. The group's attack methodology and technical capabilities have not been extensively documented due to their recent appearance and small victim count, though they appear to target specific sectors rather than conducting widespread campaigns. Exitium has been observed targeting organizations in the United States and Brazil, with a particular focus on the agriculture and food production sector as well as public sector entities, suggesting possible strategic targeting of critical infrastructure. The group remains active as of their recent emergence, though their limited victim count of two documented cases indicates they are either highly selective in their targeting, newly operational, or operating at a smaller scale compared to established ransomware groups.

Most-targeted sectors

Most-affected countries

Recent disclosures by exitium

All 10 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for exitium →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

exitium

10 victims indexed · first seen 4 months ago · last activity 1 month ago

10
Victims indexed
#209 of 364 tracked operators
3m
Active period
Mar 2026 → Jun 2026
2
Countries hit
top US · 1

At a glance

Status
active
First seen
4 months ago
Last activity
1 month ago
Onion sites
1 known endpoint
Primary sector
Agriculture and Food Production · 1 hits

About

Exitium is an emerging ransomware group that was first observed in March 2026, operating with apparent financial motivations based on their limited but documented attack patterns. Given the recent emergence and limited public documentation, specific details about the group's country of origin, organizational structure, or potential affiliations remain unclear to security researchers and law enforcement agencies. The group's attack methodology and technical capabilities have not been extensively documented due to their recent appearance and small victim count, though they appear to target specific sectors rather than conducting widespread campaigns. Exitium has been observed targeting organizations in the United States and Brazil, with a particular focus on the agriculture and food production sector as well as public sector entities, suggesting possible strategic targeting of critical infrastructure. The group remains active as of their recent emergence, though their limited victim count of two documented cases indicates they are either highly selective in their targeting, newly operational, or operating at a smaller scale compared to established ransomware groups.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2026-03-01T00:00:00+00:00 · 2
2026-03-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
1
🇧🇷 Brazil
1
United States dossier →Brazil dossier →

Top sectors

Agriculture and Food Production
1
Public Sector
1
Agriculture and Food Production dossier →Public Sector dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://m3ksukzn2glzfdvlusohril7n3iyk4z4fudf6mm22lwhpbpt5aiee5qd.onion

Source

Updated 1 month ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time exitium posts a victim.

Add exitium to your watchlist — Pro pings you within 5 minutes of any new exitium leak-site post, Telegram callout, or affiliate-rebrand inference.