This session will share how Team Cymru can track and identify upstream connectivity related to ransomware exfiltration activities via its collection of 300b+ daily NetFlow records from hundreds of ISPs around the world. This talk will focus on two key groups: Akira and Warlock. Each group's exfiltration infrastructure will be detailed in depth so that attendees can apply lessons learned to their own data sets for threat hunting, threat detection, and incident response.