BreachSense Reports Attacks by ExfilSquad & Others

Originally published on CyberNetSec.

Executive Summary

On July 27, 2026, BreachSense reported a significant number of data breaches attributed to various threat actor groups, highlighting a persistent and widespread campaign of cyberattacks. The victims span multiple sectors, including insurance, semiconductors, manufacturing, cloud hosting, and construction. Prominent threat groups named in the claims include ExfilSquad, TheGentlemen, M3RX, GlobalSecretGroup, and BravoX. This flurry of activity demonstrates the opportunistic and global nature of data theft operations, affecting major corporations and smaller businesses alike across the US, Europe, and Australia.

---

Threat Overview

The BreachSense report acts as a snapshot of daily cybercriminal activity, consolidating claims made on leak sites and underground forums. The attacks appear to be financially motivated, focusing on data exfiltration for extortion or sale. The diversity of both the attackers and the victims indicates a decentralized but highly active criminal ecosystem.

Key Incidents Reported:

• ExfilSquad: Claimed breaches against U.S. insurance corporation Allstate, semiconductor manufacturer Analog Devices, and Swedish developer Bonava.
• TheGentlemen: Attributed with an attack on Advance Marketing, a publishing company in Mexico.
• M3RX: Linked to a breach at AusProof, an Australian electrical equipment manufacturer.
• GlobalSecretGroup: Claimed responsibility for attacks on Spanish cloud host Acens and a beverage company named Al Hayat.
• BravoX: Implicated in an attack on A&A Safety, Inc., a U.S. highway construction firm.
• SECUROTROP: Claimed a breach against Advantage Sintered Metals.
• ArcusMedia: Attributed with an attack on Brazeringenierie, a telecommunications firm.
• TripleX: Claimed a breach against the Bank of Baroda in India.

Technical Analysis

While specific TTPs for each breach were not detailed, this pattern of activity is characteristic of data theft and extortion groups. Their operations typically follow a recognizable lifecycle.

General TTPs and MITRE ATT&CK Mapping

• Initial Access: Varies widely but often involves T1190 - Exploit Public-Facing Application, T1078 - Valid Accounts from infostealer logs, or T1212 - Exploitation for Client Execution via phishing.
• Discovery: Once inside, attackers perform network reconnaissance using tools like Advanced IP Scanner to map the internal network (T1018 - Remote System Discovery).
• Collection: Attackers identify and gather sensitive data from file shares and databases (T1005 - Data from Local System).
• Exfiltration: Data is staged and then exfiltrated using methods like T1567.002 - Exfiltration to Cloud Storage.
• Impact: The impact is reputational and financial, stemming from the public disclosure of the breach on the threat actor's leak site.

Impact Assessment

The collective impact of these breaches is significant. For the victim organizations, it means immediate incident response costs, potential regulatory scrutiny (e.g., GDPR, CCPA), and reputational damage. Customers and employees of these companies are exposed to risks of identity theft and fraud. For the broader business community, this report serves as a stark reminder that no industry is immune. The targeting of manufacturing, construction, and publishing alongside high-tech and finance shows that any organization with valuable data is a potential target.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams should monitor for generic signs of data theft operations:
| Type | Value | Description |
|---|---|---|
| process_name | rclone.exe, megacmd.exe, filezilla.exe | Use of data transfer tools, especially if run from unusual user contexts or on servers. |
| network_traffic_pattern | Anomalous SMB traffic to a single host from multiple endpoints. | A sign that an attacker is consolidating data from across the network onto a staging server. |
| command_line_pattern | 7z.exe a -p[password] C:\temp\stolen.7z \\fileserver\shares | Use of archiving tools with password protection to stage data for exfiltration. |

Detection & Response

1. Monitor for Data Staging: Create alerts for the creation of large archive files (.zip, .rar, .7z) on servers or endpoints, especially when initiated by service accounts or interactive user sessions on servers.
2. Egress Traffic Analysis: Analyze firewall and proxy logs for large, sustained data flows to unexpected destinations, including known cloud storage providers or unfamiliar IP addresses. This is a core part of D3FEND Outbound Traffic Filtering.
3. Credential Theft Detection: Deploy tools and rules to detect credential dumping activity using tools like Mimikatz. Monitor for anomalous access patterns that could indicate the use of stolen credentials.

Mitigation

1. Attack Surface Management: Continuously scan for and remediate exposed services and vulnerabilities on internet-facing systems to reduce initial access opportunities. This aligns with M1016 - Vulnerability Scanning.
2. Multi-Factor Authentication (MFA): Enforce MFA on all external access points (VPNs, RDP) and for access to critical internal systems and cloud services. This is a crucial implementation of M1032 - Multi-factor Authentication.
3. Data Loss Prevention (DLP): Implement DLP policies to identify and block the unauthorized transfer of sensitive data patterns (e.g., credit card numbers, social security numbers) via email, web, or other channels.