Exitium
ObscureIQ Threat Intelligence · Actor Profile
ExitiumConfidence: Medium
Data theft / extortion
Motivation: Financial
1Attributed Breaches Circulating
MediumAttribution Confidence
Data theft / extortionActor Type
Overview
Runs a Tor-based double-extortion leak site and appends a .exitium extension, first observed early 2026 with contact via the Tox platform. Early victims include a Brazilian agro-industry firm and a US appraisal district; public reporting is still limited.
Tactics, Targeting & TTPs
Bulk exfiltration then naming-and-shaming; early victims include a Brazilian agro-industry firm and a US appraisal district. Public reporting still limited.
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.