http://torzcd47rw4qh36g4yqxvv2tmifgmu6jjalkyqz4e4lzzwtfdfc7qaqd.onion/new-exfiltrator-22-post-exploitation-kit-linked-to-lockbit-ransomware/index.html
Buyers of the framework are given an admin panel hosted on a bulletproof VPS (virtual private server) from where they can control the framework’s malware and issue commands to compromised systems. The first version of the Exfiltrator-22 (EX-22) appeared in the wild on November 27, 2022, and roughly ten days later, its authors set up a Telegram channel to advertise the framework to other cybercriminals.