Xakerlar ochiq hisob ma'lumotlaridan foydalanib cheklangan korporativ ma'lumotlarga kirishadi, so'ngra bu kirishni yirik buzilishlar dalili sifatida taqdim etib, kompaniyalarni to'lashga majbur qiladi.
Topilmalar ReliaQuest muhitining buzilishini emas, balki uchinchi tomonlarga ta'sir qiluvchi tashqi hujumchi faoliyatini o'z ichiga oladi.
Ular muhim farqni ta'kidlaydi: haqiqiy sizib chiqqan yozuvlar avtomatik ravishda to'lov guruhi da'vo qilgan keng tarmoq kirishini isbotlamaydi.
Birinchi marta 2026-yil iyulda kuzatilgan ExfilSquad xodimlar ismlari, taxalluslar, identifikatorlar, elektron pochta manzillari, telefon raqamlari va ish joylari joylashuvini o'z ichiga olgan JSON namunalarini e'lon qildi.
Namunalar shuningdek bo'sh maydonlar va umumiy mijozlar bilan munosabatlarni boshqarish ma'lumotlarini ham o'z ichiga olgan. ReliaQuest bu material kengroq tarmoq buzilishi yoki ijarachi buzilishini isbotlamasligini baholadi.
Tadqiqotchilar hujumchining GitHub'da ochiq hisob ma'lumotlarini qidirishi, so'ngra shu hisoblar ruxsat bergan har qanday ma'lumotni olishiga juda ishonchli deb hisoblashadi.
Bu baholash ehtimoliy tushuntirish bo'lib qoladi, har bir da'vo qilingan hodisaning tasdiqlangan qayta qurilishi emas.
ExfilSquad veb-sayti "kelishuvni bajarmagan" kompaniyalarni e'lon qilishini da'vo qiladi, oshkor qilishlarni to'lanmagan talablar natijasi sifatida taqdim etadi.
Biroq, tadqiqotchilar o'tkazib yuborilgan e'lon muddatlari va qo'llab-quvvatlovchi namunalar bo'lmagan ro'yxatlarni kuzatishdi. Hech biri buzilish sodir bo'lmaganini isbotlamaydi, lekin ikkalasi ham saytning tasdiqlangan buzilishlar taqdimotini zaiflashtiradi.
Ehtimoliy oqibatlar ochiq xodimlarga qarshi maqsadli fishing va da'volarni tekshirish operatsion xarajatlarini o'z ichiga oladi.
ExfilSquad ma'lumotlar sizib chiqish sayti axborot sahifasi, kelishuvni bajarmagan kompaniyalarni e'lon qilishni da'vo qiladi (Manba: ReliaQuest).
ReliaQuestning Tahdid Tadqiqot jamoasi ExfilSquadni ehtimoliy misol sifatida aniqladi va ransomware uslubidagi sizib chiqish saytlari buzilishlar miqyosini isbotlamasdan ularni bo'rttirib ko'rsatishi mumkinligi haqida ogohlantirdi.
Shuning uchun tashkilotlar haqiqiy hisob ma'lumotlaridan suiiste'mol qilishni keng ma'lumotlar o'g'irlanishi haqidagi asossiz da'volardan ajratishi kerak.
Bu faoliyat ransomware hisobotidagi kengroq buzilish bilan birga keladi. Sizib chiqish saytlarida nomlangan tashkilotlar 2026-yilning uchinchi choragida 30% ga oshdi, lekin 43 ta yangi kuzatilgan guruh bu o'sishning 93% ini tashkil etdi.
Ma'lumotlar sizib chiqish saytlarida nomlangan ishlab chiqarish qurbonlari uchinchi chorakda 70% ga o'sdi, PSTS yetakchiligini 420 qurbonidan 106 gacha qisqartirdi.
Uchinchi chorak 2026-yilda sektor bo'yicha ma'lumotlar sizib chiqish saytlarida ro'yxatga olingan tashkilotlarning umumiy soni (Manba: ReliaQuest).
Ikkinchi va uchinchi chorakda faol bo'lgan guruhlardan ro'yxatlar atigi 1% ga oshdi.
ReliaQuest yangi ro'yxatlar yangi kirishlar, qayta brendlar, qayta ishlatilgan ma'lumotlar va yolg'on da'volarni birlashtirishi mumkinligi haqida ogohlantirdi.
Global Secret Group 48 ta ro'yxatga olingan qurbonlaridan 28 tasini bir kunda e'lon qildi, crpx0 esa 47 tadan 41 tasini bir vaqtda joylashtirdi. Bunday partiyalar oldindan to'plangan materialni ko'rsatadi, garchi ular soxtalashtirishni isbotlamasa ham.
Barcha ro'yxatga olingan qurbonlar orasida AQSh ulushi ketma-ket ikkinchi chorakda pasaydi: birinchi chorakda 55% dan, ikkinchi chorakda 49% gacha, uchinchi chorakda 41% gacha.
Ma'lumotlar sizib chiqish sayti qurbonlarining AQSh ulushi, 2026-yil birinchi, ikkinchi va uchinchi choraklari (Manba: ReliaQuest).
Shuning uchun, sizib chiqish sayti yozuvlarini sanash muvaffaqiyatli ransomware hujumlarini ishonchli o'lchay olmaydi. Faqat o'rnatilgan guruh nomlarini kuzatish ham chorakning deyarli barcha o'sishini o'tkazib yuborgan bo'lardi.
Himoyachilar e'lon qilingan namunalarni ichki yozuvlar, autentifikatsiya telemetriyasi, ilova kirish jurnallari va eksport faoliyati bilan solishtirishlari kerak.
Tergovchilar ruxsatsiz kirish sodir bo'lganmi, qanday ma'lumotlarga kirish mumkin bo'lganmi va dalillar hujumchining hisobini qo'llab-quvvatlaydimi yoki yo'qligini aniqlashlari kerak, shundan so'ng cheklash ustuvorliklarini belgilash mumkin.
Repozitoriy ochiqligi alohida e'tiborni talab qiladi. GitHubning maxfiy skanerlash hujjatlari skanerlash filiallar bo'yicha repozitoriy tarixini qamrab olishi va parollar, tokenlar va API kalitlari kabi hisob ma'lumotlarini aniqlashini tushuntiradi.
Ochiq hisob ma'lumotlari darhol aylantirilishi kerak; ularni faqat manba kodidan olib tashlash ularni bekor qilmaydi.
ReliaQuest shuningdek CRM va portal jurnallarini g'ayrioddiy ommaviy o'qishlar uchun tekshirish, ochiq maxfiy ma'lumotlarni bekor qilish va tashkilotlar va sotuvchilarga sizib chiqish sayti havolalarini kuzatishni tavsiya qiladi.
Bu choralar shubhali kirish yo'lini hal qiladi, to'lovchining hikoyasini haqiqat sifatida qabul qilmasdan.
Kengroq StopRansomware Qo'llanmasi ransomware va ma'lumotlar to'lovlari uchun tegishli tayyorgarlik, oldini olish va yumshatish yo'riqnomalarini taqdim etadi.
Xavfsizlik jamoalari uchun ustuvorlik dalillarga asoslangan javob: da'voni tekshirish, tasdiqlangan ochiqlikni cheklash va tahdidli ro'yxatni isbotlangan korporativ keng buzilish bilan tenglashtirishdan qochish.
Hackers are using exposed credentials to access limited corporate data, then presenting that access as evidence of major breaches to pressure companies into paying.
The findings concern external attacker activity affecting third parties, not a compromise of ReliaQuest’s environment.
They highlight a distinction: authentic leaked records do not automatically prove the extensive network intrusion an extortion group claims.
First observed in July 2026, ExfilSquad published JSON samples containing employee names, aliases, identifiers, email addresses, telephone numbers, and workplace locations.
The samples also included empty fields and general customer relationship management information. ReliaQuest assessed that the material did not establish a broader network breach or tenant compromise.
Researchers believe the actor very likely searches GitHub for exposed credentials, then retrieves whatever information those accounts permit it to access.
That assessment remains a likely explanation, not a confirmed reconstruction of every claimed incident.
ExfilSquad’s website claims it publishes companies that “fail to meet an agreement,” portraying disclosures as consequences of unpaid demands.
However, researchers observed missed publication deadlines and listings without supporting samples. Neither proves that no compromise occurred, but both weaken the site’s presentation of verified breaches.
The likely consequences include targeted phishing against exposed employees and the operational cost of investigating allegations.
ExfilSquad data leak site informational page, claiming to publish companies that fail to meet an agreement (Source : ReliaQuest).
ReliaQuest’s Threat Research team identified, ExfilSquad as a likely example, warning that ransomware-style leak sites can exaggerate compromises without substantiating the scale of intrusion they imply.
Organizations must therefore distinguish genuine credential abuse from unsupported claims of extensive data theft.
The activity accompanies a broader distortion in ransomware reporting. Organizations named on leak sites increased 30% during Q3 2026, but 43 newly observed groups accounted for 93% of that growth.
Manufacturing victims named on data-leak sites grew by 70% in Q3, cutting PSTS lead from 420 victims to 106.
Total number of organizations listed on data leak sites by sector, Q3 2026 (Source : ReliaQuest).
Listings from groups active in both Q2 and Q3 increased just 1%.
ReliaQuest cautioned that new listings may combine fresh intrusions, rebrands, recycled information, and false allegations.
Global Secret Group published 28 of its 48 listed victims on one day, while crpx0 posted 41 of 47 simultaneously. Such batches suggest precollected material, although they do not establish fabrication.
The US share of all listed victims fell for the second consecutive quarter: from 55% in Q1, to 49% in Q2, to 41% in Q3.
US share of data leak site victims, Q1 vs. Q2 vs. Q3 2026 (Source : ReliaQuest).
Consequently, counting leak-site entries cannot reliably measure successful ransomware attacks. Tracking established group names alone would also have missed almost all the quarter’s increase.
Defenders should compare published samples with internal records, authentication telemetry, application access logs, and export activity.
Investigators must establish whether unauthorized access occurred, what information was reachable, and whether the evidence supports the attacker’s account before determining containment priorities.
Repository exposure deserves particular attention. GitHub’s secret-scanning documentation explains that scanning covers repository history across branches and detects credentials such as passwords, tokens, and API keys.
Exposed credentials should be rotated immediately; removing them from source code alone does not invalidate them.
ReliaQuest also recommends reviewing CRM and portal logs for unusual bulk reads, revoking exposed secrets, and monitoring leak-site references to organizations and vendors.
These measures address the suspected access route without accepting an extortionist’s narrative as fact.
The broader StopRansomware Guide provides related preparation, prevention, and mitigation guidance for ransomware and data extortion.
For security teams, the priority is evidence-led response: investigate the allegation, contain verified exposure, and avoid equating a threatening listing with a proven enterprise-wide breach.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.