Loading story…
Everest ransomware group claimed responsibility for breaching Petrobras, Brazil's state-owned oil and gas giant, and exfiltrating over 90 GB of sensitive seismic navigation data. The stolen files reportedly include detailed technical information such as ship positioning, equipment configurations, hydrophone readings, depth measurements, and quality control documents related to Petrobras' seismic surveys, particularly in the Campos Basin. Screenshots of the stolen data were published by the threat actors to substantiate their claims, and the data is said to include both 3D and 4D survey datasets, which are critical for oil exploration and production.
The breach poses a significant reputational risk to Petrobras and could undermine its competitive advantage, as the exposed data may allow competitors to replicate Petrobras' methods or gain leverage in contract negotiations. While the data does not appear to include real-time corporate access, the leak of such proprietary research and technical documentation could have long-term strategic implications for Petrobras. Everest's claims follow a pattern of targeting major industrial and energy sector organizations worldwide.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
After claiming the intrusion, Everest said it would release the allegedly stolen Petrobras data in less than a week. Reported impacts centered on reputational harm and possible competitive disadvantage from exposure of ship positioning and equipment usage details.
The Everest ransomware operation allegedly compromised Petrobras and claimed to have exfiltrated about 90 GB of data. The group said the stolen material included sensitive geophysical and navigation-related information related to Petrobras' Campos Basin post-salt research.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Everest ransomware group has publicly claimed responsibility for a significant breach of ASUS, a leading global hardware and electronics manufacturer. According to statements posted on a dark web leak site, Everest alleges it has stolen over 1TB of data from ASUS, including proprietary camera source code, firmware, and potentially other sensitive intellectual property. The group has demanded that ASUS contact them via the encrypted messaging platform Qtox within 21 hours, though no ransom amount has been disclosed. At this time, ASUS has not confirmed or denied the breach, and the exact nature and sensitivity of the compromised data remain unverified. This incident follows a pattern of recent Everest ransomware claims against other high-profile organizations, such as Under Armour, Petrobras, and Iberia airline, which involved theft of user data and internal documentation. If substantiated, the breach would represent a major compromise for ASUS, which previously suffered the ShadowHammer supply chain attack in 2019. The situation underscores the ongoing threat posed by ransomware groups to major technology manufacturers and the potential for large-scale intellectual property theft and operational disruption.
Jun 29, 2026
Ecopetrol, Colombia's state-linked energy company, confirmed a ransomware-related intrusion after attackers accessed its IT infrastructure and stole pseudonymous data associated with **3,300 user accounts**. Reporting tied the incident to the threat group **thegentlemen**, with claims that more than **1 TB of data** was involved in the compromise of the company, which operates refineries, pipelines, ports, and international energy assets. The company said the attackers attempted to deploy an encryptor, but security controls blocked the encryption phase and prevented disruption to transactional systems and partner networks. Ecopetrol stated that no user identities or credentials were compromised, that the threat actors were removed from its environment, and that an internal investigation is underway; Colombian authorities, including the Attorney General's Office and the Military Forces' Joint Cyber Command, were also notified.
Jul 20, 2026
The Everest ransomware operation claimed it stole data tied to **Citizens Financial Group** and **Frost Bank** and threatened to publish the information after listing both institutions on its leak site. Reports said Everest alleged it held nearly **3.4 million** Citizens-related records from a SQL database dump and about **250,000** Frost customer records, with sample data purportedly including personal and financial information. The gang gave the organizations a short deadline before release and framed the incident as part of its broader double-extortion campaign. Both banks said their own internal networks were not directly compromised and attributed the exposure to a **third-party vendor**. Citizens said the material involved mostly **masked test data** with only limited real customer information, while Frost said it had brought in external cybersecurity experts to investigate. The activity was linked to Everest, a Russia-linked ransomware-as-a-service group that has previously targeted major enterprises including Nissan, Collins Aerospace, Iberia Airlines, Under Armour, and BMW.
Jun 29, 2026