Loading story…
Romania’s national oil pipeline operator Conpet reported a cyberattack that disrupted corporate IT services and took its public website offline, while stating that operational technology (including pipeline control and telecommunications systems) remained functional and oil transport continued. The Qilin ransomware group claimed responsibility, and reporting indicated the actor alleged data theft on the order of ~1TB, publishing purported proof such as internal documents, financial records, and scanned passports on its leak site.
Separate reporting described an unrelated cloud-focused cybercrime campaign attributed to TeamPCP (aka PCPcat / ShellForce), which has been compromising exposed and misconfigured cloud management interfaces at scale using automated, worm-like propagation. The activity was assessed as leveraging broad scanning and “industrialized” use of known weaknesses and misconfigurations (rather than novel exploits) to hijack infrastructure and monetize access, with claims of at least ~60,000 servers compromised globally since late December.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
After confirming the breach, Conpet said data had been exfiltrated but the volume was still under investigation. It warned that leaked personal and financial information could be abused for fraud and urged people to verify suspicious requests through official channels.
Conpet said it was hit by a Qilin ransomware attack the previous week that compromised its corporate IT infrastructure. The company stated that pipeline operations were unaffected and that it was investigating with Romania's National Cyber Security Directorate.
The Russia-based Qilin ransomware group claimed it had exfiltrated nearly 1 TB of data from Conpet and posted sample documents to support the claim.
SafePay claimed responsibility for a ransomware attack against Conduent and alleged that it stole 8.5 TB of data from the company.
German authorities warned about phishing messages impersonating 'Signal Support' that attempt to trick targets into sharing SMS PIN or verification codes for Signal accounts.
The U.S. Cybersecurity Information Sharing Act of 2015 was reauthorized through September 30, 2026 via the Consolidated Appropriations Act, 2026, preserving liability protections for certain cyber information sharing.
Talos-linked reporting said the DKnife toolkit has been used since 2019 to compromise routers and hijack software downloads and updates, delivering ShadowPad and DarkNimbus malware. The activity was assessed with high confidence as China-nexus.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourceresearch.checkpoint.com
Open sourcesherpaintelligence.substack.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Romania’s national oil pipeline operator **Conpet** confirmed a cyberattack that disrupted parts of its corporate IT environment and rendered its public website inaccessible, while stating that core oil transport operations were not impacted. Conpet reported that its operational technology environment—including **SCADA** and telecommunications systems—remained fully functional, and said it took immediate mitigation steps, engaged Romania’s national cybersecurity authorities to support the investigation and recovery, and filed a criminal complaint. The **Qilin** ransomware operation (a Russian-speaking **ransomware-as-a-service** group) claimed responsibility by listing Conpet on its leak site and alleging theft of nearly **1 TB** of data; the group posted samples it says are internal documents, including financial records and passport scans. Reporting characterized Qilin as a highly active and destructive actor with prior victims across public and private sectors internationally, and noted the incident occurs amid a broader pattern of ransomware activity affecting Romanian organizations and critical services.
Jun 29, 2026
Ransomware monitoring sources recorded a surge of victim claims led by **Qilin**, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included **Cafar**, **Droguería Martorani**, **AK Preparedness**, **Armara**, **Sicc**, **KLD Labs**, **St Martha Catholic Church**, **Salina Supply**, **The Nueva School**, **City Ambulance Service**, **Famesa**, **Associated Theatrical Contractors**, **Don Tortaco Mexican Grill**, **Eana**, **PP+K**, **Synergy Products**, and **Bolt & Nut Manufacturing**. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign. Other groups also continued to post new victims. **Incransom** claimed attacks on **v-silicon.com** in Taiwan, **Reatile Group** in South Africa, **Vedan Corp** in Vietnam, and **V&P Nurseries** in the United States; **DragonForce** claimed **NewNet S.A.** in Colombia and separately threatened Switzerland's **Ifage** with publication of **850 GB** of allegedly stolen data after an earlier intrusion; **Krybit** listed **Euroins Insurance Company AD** in Bulgaria; and **Akira** claimed **McKeever, Varga & Senko** in the United States, alleging theft of **12 GB** of corporate and personal data. A weekly ransomware trend report based on **eCrime.ch** data counted **187** claims for the period, down from **233** the prior week, but still identified **Qilin** as the most active group with **33** claims, ahead of **DragonForce** with **27**.
Jul 21, 2026
The Qilin ransomware group, also known as Agenda, has adopted a sophisticated cross-platform attack strategy by deploying Linux-based ransomware binaries on Windows systems. This technique leverages legitimate remote management and file transfer tools such as Splashtop, WinSCP, AnyDesk, ATERA RMM, ScreenConnect, and MeshCentral to bypass traditional Windows-centric endpoint detection and response (EDR) solutions. Attackers gain initial access through social engineering, including fake CAPTCHA pages, and use credential theft to facilitate lateral movement and privilege escalation. The group also employs Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security defenses and steals backup credentials, particularly from Veeam, to prevent recovery and maximize extortion leverage. Qilin's operations have impacted over 700 victims globally since January 2025, with a focus on sectors such as manufacturing, professional and scientific services, and wholesale trade. The group uses a double-extortion model, exfiltrating sensitive data with tools like Cyberduck before encrypting files and threatening public disclosure. Qilin's affiliates have been observed using a variety of post-exploitation tools, including Mimikatz and custom scripts, to harvest credentials and exfiltrate data. The group's rapid evolution and ability to evade detection highlight the growing sophistication of ransomware-as-a-service (RaaS) operations targeting organizations worldwide.
Jun 29, 2026