exitium

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
exitium ransomware
*/

rule exitium_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.exitium"
        description = "Detects exitium ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "exitium" ascii nocase
        $name2 = "EXITIUM" ascii
        $onion  = "exitium.onion" ascii nocase

    condition:
        any of them
}

----------------------------------------------------------------------------------------------------
Hello, Management!
Files from your infra have been encrypted by Exitium ransomware!
All data, including passports, IDs, employes, healthcare and other data has been encrypted and can be lost irrevocable!
CONTACT US WITHIN 168 HOURS OR YOUR FILES WILL STAY ENCRYPTED FOREVER
NO NEED TO TRY DELETE OR MODIFY ENCRYPTED FILES!
THIS WILL LEAD TO IMPOSSIBILITY OF FILE DECRYPTION
How to contact us:
1. Download [redactado] here - [redactado]
2. Go to 'Add Friend' and send request to this TOX_ID: [redactado]
3. After you contact us we will start negotiations
Option of reporting to the FBI or police or any other service is pointless because they would not help you and forbid you paying the amount we are after.
This would momentarily lead to data loss and you will lose any chance of decryption.
From our side we guarantee that you will receive your data after payment because we are no hacktivists and not politically motivated.
We will leave the ransom, paying, negotiating process as a secret and will not expose this case to any public and remove your files from our storage.
OUR BLOG(Tor link): [redactado]
----------------------------------------------------------------------------------------------------

• https://www.ransomware.live/group/exitium