Loading story…
Zephyr Energy plc disclosed a cyber incident in which about £700,000 was diverted after a payment intended for a contractor was rerouted to an attacker-controlled third-party account. The company said a U.S. subsidiary was targeted in what it described as a "highly sophisticated" attack affecting a routine payment process, though it did not reveal the intrusion method or technical details behind the compromise.
Zephyr said it notified law enforcement and is working with banks and external consultants to try to recover the funds. The company added that consultants reviewed its systems, the incident has been contained, and normal operations were not disrupted. Zephyr also told investors it has sufficient working capital to absorb the loss and has implemented additional security measures following the fraud.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Zephyr Energy disclosed the incident publicly, said it had notified law enforcement, and began working with banks and external consultants to try to recover the funds. The company also said consultants reviewed its systems, the incident was contained, operations were not disrupted, and additional security measures were implemented.
Zephyr Energy said a highly sophisticated cyberattack targeted the routine payment process of one of its American subsidiaries, causing roughly £700,000 intended for a contractor to be diverted to a third-party account controlled by the attacker. The company did not disclose the specific intrusion method.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceitpro.com
Open sourcego.theregister.com
Open sourcetheregister.com
Open sourcetechcrunch.com
Open sourcepolaris.brighterir.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered **Phantom Deal**, an M&A-themed business-email-compromise and advance-payment fraud campaign that impersonates executives and advisers to manufacture confidential acquisition transactions. In an attempted theft targeting Gen Digital's legal team, operators used WhatsApp, personal email, realistic corporate details, and a forged PwC-branded non-disclosure agreement to pressure Avast Software s.r.o. into wiring **€626,735.45** to a Hong Kong company. The targeted employee identified an inconsistency in the impersonator's voice and did not send funds. The attackers sought to isolate the employee from normal corporate channels, weaponizing deal secrecy to bypass legal, finance, treasury, compliance, and corporate-development review. During a controlled engagement, Gen researchers recorded repeated accesses to a canary-linked false payment confirmation; the fraudsters also requested SWIFT MT103 and UETR payment-tracking details. Analysis linked the operation to four additional targets and a reusable toolkit using PwC, KPMG, and Ogier branding, although investigators found no evidence that those firms were compromised or involved. Organizations should require independent out-of-band verification for executive-directed payments and confidential transaction requests.
Sep 4, 2026
Unknown cyber actors targeted a US renewable energy company in a spear-phishing campaign that impersonated a US-based financial institution and promised access to more than **$62 million** in funding. The phishing email used a fraudulent loan theme, spoofed financial and government-linked entities through registered domains, email subjects, and attached PDFs, and directed the recipient to download a fake Windows banking application from `secureportal[.]online`. Supporting lures included a document spoofing the UK National Crime Agency and another appearing to contain **SWIFT** information, indicating an effort to build credibility across multiple institutions. The FBI, in coordination with **DHS-CISA**, said the malicious executable contacted `secureportal[.]online` and warned that the activity matched a broader campaign active since at least 2017. Additional reporting linked the infrastructure to numerous lookalike domains, fake login portals, and backdoored installers masquerading as banks in multiple regions; the installers were reportedly built with the open-source **Squirrel** framework and likely delivered TeamViewer-derived remote access trojans with low antivirus detection. Authorities recommended updated anti-malware, application control, reduced administrator privileges, and careful verification of unsolicited emails, attachments, and web addresses.
Aug 15, 2026
Researchers at F6 reported a new wave of financially motivated attacks by **Hive0117** targeting accountants at companies in Russia and other CIS countries, using phishing emails disguised as routine accounting documents. The messages carry password-protected RAR archives that infect victims with the fileless **DarkWatchman** malware and a keylogger, giving the attackers access to remote banking systems used by businesses. Victims have also been identified in Belarus, Kazakhstan, and Uzbekistan, and the group has reportedly been active since at least 2021. F6 estimates Hive0117 has conducted about **400 successful intrusions** since the start of the year, with average losses rising from **3 million to 10 million rubles**. In the latest campaign, the group reportedly shifted from direct theft to fraudulent **payroll register** payments, making unauthorized transfers appear to be legitimate salary disbursements while routing the money to drop accounts. The operation highlights continued targeting of finance departments through credential theft, keylogging, and abuse of trusted business payment workflows.
Jun 29, 2026