exitium Ransomware Group

Key insights

• •Exitium employs a double extortion model by both encrypting data and exfiltrating sensitive information.
• •The group uses living-off-the-land (LotL) techniques for lateral movement and privilege escalation before deploying their ransomware.
• •Their ransomware variants typically append the '.exitium' file extension to locked files.
• •They target a variety of industries, including energy, agriculture, and manufacturing.
• •Exitium's attacks are characterized by sophisticated encryption methods, likely involving AES-256 and RSA-4096.
• •They operate a dedicated leak site on the Tor network to pressure victims into paying ransoms.