Loading story…
Oltenia Energy Complex, Romania's largest coal-based energy producer, suffered a ransomware attack attributed to the Gentlemen ransomware group. The incident, detected on December 26, resulted in the encryption of documents and files, and caused temporary unavailability of critical IT applications, including ERP systems, document management, email services, and the company website. Despite the disruption, the operation of the National Energy System was not jeopardized, and the company's activity was only partially affected.
Upon discovery, the affected systems were isolated and IT teams began rebuilding infrastructure using existing backups. The company reported the incident to the National Cyber Security Directorate, the Ministry of Energy, and filed a criminal complaint with law enforcement agencies. Investigations are ongoing to determine the full impact and whether any data was exfiltrated prior to encryption. The Gentlemen ransomware group is known for exploiting compromised credentials and targeting internet-exposed services, deploying ransom notes and encrypting files with the .7mtzhh extension.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By 2025-12-29, reporting attributed the Oltenia Energy Complex intrusion to the Gentlemen ransomware group. At that time, the group had not listed the company on its leak site, suggesting negotiations or an unfinalized extortion phase.
After detecting the attack, the company notified Romanian authorities, cooperated with the National Cyber Security Directorate and DIICOT, and filed a criminal complaint. Law enforcement and incident responders opened an investigation into the ransomware incident.
Following the attack, Oltenia Energy Complex isolated affected systems and began restoring services using backups and newly built infrastructure. The organization also continued assessing the scope of the incident, including whether any data was exfiltrated.
On 2025-12-26, Romania's Oltenia Energy Complex suffered a ransomware attack that disrupted its IT infrastructure and encrypted documents and applications. Affected systems reportedly included ERP, email, and the company website, while the National Energy System was not impacted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcestiripesurse.ro
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Romania's national water management agency, Administrația Națională Apele Române (Romanian Waters), suffered a significant ransomware attack that compromised around 1,000 systems, including servers, workstations, and critical IT infrastructure. The attackers used Microsoft's BitLocker, a legitimate Windows encryption tool, to lock files and left ransom notes demanding negotiations within seven days. Despite the widespread IT disruption, operational technologies such as dams and flood defenses remained unaffected, and hydrotechnical operations continued with staff relying on alternative communication methods like telephone and radio due to email outages. Authorities have not attributed the attack to a known ransomware group and have advised against negotiating with the attackers. The Romanian National Cyber Security Directorate (DNSC) confirmed that the attack impacted ten of the country's eleven river basin management organizations, but emphasized that water infrastructure operations were not disrupted. The use of BitLocker as a "living off the land" technique highlights a trend where attackers leverage built-in system tools to evade detection and complicate incident response. The DNSC reiterated its policy of not engaging with cyber extortionists and urged IT teams to focus on system restoration rather than external communications. The agency continues to investigate the incident and work towards full remediation of affected systems.
Jun 29, 2026
Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT services and took its public website offline, while stating that operational technology (including pipeline control and telecommunications systems) remained functional and oil transport continued. The **Qilin** ransomware group claimed responsibility, and reporting indicated the actor alleged data theft on the order of **~1TB**, publishing purported proof such as internal documents, financial records, and scanned passports on its leak site. Separate reporting described an unrelated cloud-focused cybercrime campaign attributed to **TeamPCP** (aka **PCPcat** / **ShellForce**), which has been compromising exposed and misconfigured cloud management interfaces at scale using automated, worm-like propagation. The activity was assessed as leveraging broad scanning and “industrialized” use of known weaknesses and misconfigurations (rather than novel exploits) to hijack infrastructure and monetize access, with claims of at least **~60,000** servers compromised globally since late December.
Jun 29, 2026
Romania’s national oil pipeline operator **Conpet** confirmed a cyberattack that disrupted parts of its corporate IT environment and rendered its public website inaccessible, while stating that core oil transport operations were not impacted. Conpet reported that its operational technology environment—including **SCADA** and telecommunications systems—remained fully functional, and said it took immediate mitigation steps, engaged Romania’s national cybersecurity authorities to support the investigation and recovery, and filed a criminal complaint. The **Qilin** ransomware operation (a Russian-speaking **ransomware-as-a-service** group) claimed responsibility by listing Conpet on its leak site and alleging theft of nearly **1 TB** of data; the group posted samples it says are internal documents, including financial records and passport scans. Reporting characterized Qilin as a highly active and destructive actor with prior victims across public and private sectors internationally, and noted the incident occurs amid a broader pattern of ransomware activity affecting Romanian organizations and critical services.
Jun 29, 2026