Wednesday, May 7, 2025
HomeCyber Security NewsResearchers Detailed New Exfiltration Techniques Used By Ransomware Groups

Researchers Detailed New Exfiltration Techniques Used By Ransomware Groups

Published on

SIEM as a Service

Follow Us on Google News

Ransomware groups and state-sponsored actors increasingly exploit data exfiltration to maximize extortion and intelligence gains by leveraging a mix of custom and legitimate tools to steal sensitive data, including financial, personal, and classified information. 

To mitigate risks, organizations must implement robust security measures, such as network monitoring, file integrity checks, and endpoint detection and response, to detect and thwart data exfiltration attempts early on.

Attacks are increasingly leveraging data exfiltration as a primary extortion tactic, where cybercriminals are shifting away from traditional encryption-based attacks due to their resource-intensive nature and the growing ability of organizations to recover from them. 

- Advertisement - Google News

Data exfiltration, on the other hand, is less resource-intensive and harder to detect, making it a more attractive option.

Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.

By stealing sensitive data, attackers can extort victims with threats of public exposure or private sale, highlighting the evolving threat landscape and the need for organizations to prioritize data protection and incident response strategies.

Akira’s ransomware operators statement during negotiations on the group’s dedicated portal

Groups are collaborating with state-sponsored actors to enhance their capabilities and achieve mutual objectives, where state-sponsored groups leverage ransomware to disguise intelligence gathering operations, while ransomware groups benefit from advanced techniques and access to sensitive information. 

Both actors target high-value data, including financial and insurance-related information, to maximize extortion potential and gain strategic advantages, which poses significant cybersecurity risks as it blurs the lines between criminal and state-sponsored activities, making threat attribution and mitigation more challenging.

It exfiltrates highly sensitive data, including confidential documents, government data, personal information, and medical records, by targeting IT infrastructure data, such as password management software, network architecture, and source code. 

Recently edited files are also prioritized to gain insights into ongoing projects and sensitive information, which is used for extortion, resale, and future attacks, causing significant reputational and financial damage to victims.

Exfiltartion-related stages observed in a ransomware campaign

By employing a multi-stage exfiltration process, they leverage both custom and publicly available tools, which offer tailored functionality, improved stealth, and reduced dwell time, primarily used by advanced groups. 

Scripts automate exfiltration and payload delivery, while enumeration tools aid in data discovery.

Exfiltration tools like ExByte, ExMatter, and StealBit directly transfer stolen data to threat actor-controlled servers or cloud storage, often employing techniques to evade detection and hinder recovery efforts.

They are increasingly employing commodity malware and legitimate tools to exfiltrate sensitive data, where infostealers like Meduza and CSharp Streamer are used to collect data, while tools like WizTree, WinRAR, 7-Zip, Rclone, and Mega facilitate exfiltration. 

Attackers often leverage cloud storage solutions and file-sharing platforms to host stolen data, while detecting exfiltration attempts involves monitoring for suspicious file movements, tool usage, and network traffic anomalies. 

According to Sekoia, for the purpose of identifying and mitigating risks associated with ransomware-related data exfiltration, proactive monitoring, anomaly detection, and correlation rules are fundamental.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

Aman Mishra
Aman Mishra
Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Latest articles

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector...

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its...

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

SpyCloud, the leading identity threat protection company, today released an analysis of nearly 6...

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector...

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its...

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect...