Executive Summary
ExfilSquad is an emerging data extortion group that surfaced in July 2026, claiming to have exfiltrated sensitive data from 15 organizations including Microsoft, Frontier Airlines, and several government entities. Unlike traditional ransomware actors, ExfilSquad focuses on SaaS data exfiltration without deploying encryption payloads or performing lateral movement. Their primary technique involves identifying Microsoft Power Pages portals where the 'Anonymous Users' web role has been incorrectly granted read permissions for Dataverse tables.
The group has demonstrated credibility by leaking approximately 382 GB of data (27 million records) via torrents and anonymous file-sharing sites. The breached data contains extensive PII, corporate records, and CRM metadata. While the group operates a Tor leak site, their backend infrastructure has been linked to IP 209.99.188[.]199, which has also been observed hosting ScreenConnect backdoors.