Exitium is a 64-bit Windows ransomware first seen in March 2026. It appends .exitium to encrypted files and leaves an HTML note named YOU ARE UNDER ATTACK!.html addressed to "Management". The note gives a 168-hour window and tells victims to reach the operators by adding a Tox ID in the qTox client. It lists no email address. Exitium goes after organisations rather than home users. It has posted victims in the Americas and Asia, including energy, agribusiness and public-sector bodies, on a Tor leak site. Its note stresses personal and healthcare records, which points to data theft before encryption. No code lineage has been published.
File extensions: .exitium
Ransom note filenames: YOU ARE UNDER ATTACK!.html
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161