http://torzcd47rw4qh36g4yqxvv2tmifgmu6jjalkyqz4e4lzzwtfdfc7qaqd.onion/new-exfiltrator-22-post-exploitation-kit-linked-to-lockbit-ransomware/index.html
Creating scheduled tasks through EX-22’s panel (CYFIRMA) Through the service’s web panel, cybercriminals can also set scheduled tasks, update agents to a new version, change a campaign’s configuration, or create new campaigns. Linked to LockBit ransomware members The CYFIRMA team has found evidence that LockBit 3.0 affiliates or members of the ransomware operation’s development team are behind EX-22.