Loading story…
Ecopetrol, Colombia's state-linked energy company, confirmed a ransomware-related intrusion after attackers accessed its IT infrastructure and stole pseudonymous data associated with 3,300 user accounts. Reporting tied the incident to the threat group thegentlemen, with claims that more than 1 TB of data was involved in the compromise of the company, which operates refineries, pipelines, ports, and international energy assets.
The company said the attackers attempted to deploy an encryptor, but security controls blocked the encryption phase and prevented disruption to transactional systems and partner networks. Ecopetrol stated that no user identities or credentials were compromised, that the threat actors were removed from its environment, and that an internal investigation is underway; Colombian authorities, including the Attorney General's Office and the Military Forces' Joint Cyber Command, were also notified.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Ecopetrol stated it had removed the attackers from its environment, opened an internal investigation, and notified Colombian authorities including the Attorney General's Office and the Military Forces' Joint Cyber Command. The company also said no user identities or credentials were compromised.
Ecopetrol confirmed that attackers accessed its IT infrastructure and stole pseudonymous data from 3,300 user accounts. The company said an attempted encryptor deployment was blocked by security controls, preventing disruption to transactional systems and partner networks.
The Ecopetrol incident was publicly discovered or reported on July 19, 2026 at 10:13 UTC, identifying the Colombian energy company as a victim of thegentlemen.
Ecopetrol was reportedly breached in a ransomware attack attributed to thegentlemen. The incident was dated July 17, 2026, and more than 1 TB of data was said to be involved.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Everest ransomware group claimed responsibility for breaching Petrobras, Brazil's state-owned oil and gas giant, and exfiltrating over 90 GB of sensitive seismic navigation data. The stolen files reportedly include detailed technical information such as ship positioning, equipment configurations, hydrophone readings, depth measurements, and quality control documents related to Petrobras' seismic surveys, particularly in the Campos Basin. Screenshots of the stolen data were published by the threat actors to substantiate their claims, and the data is said to include both 3D and 4D survey datasets, which are critical for oil exploration and production. The breach poses a significant reputational risk to Petrobras and could undermine its competitive advantage, as the exposed data may allow competitors to replicate Petrobras' methods or gain leverage in contract negotiations. While the data does not appear to include real-time corporate access, the leak of such proprietary research and technical documentation could have long-term strategic implications for Petrobras. Everest's claims follow a pattern of targeting major industrial and energy sector organizations worldwide.
Jun 29, 2026
A ransomware attack on Colonial Pipeline’s IT environment forced the company to temporarily halt pipeline operations, causing fuel supply disruptions across parts of the United States. Dragos said with high confidence that the **DarkSide** ransomware group was responsible for the compromise and described the incident as the most disruptive cyber intrusion it had seen affecting U.S. energy infrastructure. The shutdown highlighted how closely linked IT and OT environments can be in industrial organizations, allowing an enterprise-system intrusion to trigger major operational consequences. As Colonial Pipeline restarted service, U.S. officials warned that fuel availability would recover gradually and urged the public not to panic-buy gasoline or accept price gouging. The FBI said the Russian government was not behind the attack, though the perpetrators were believed to be operating from Russia. Reporting on the incident also pointed to common ransomware entry paths, including weak passwords on internet-exposed services and exploitation of devices such as **Pulse Connect Secure**, **Fortinet FortiOS**, and **Accellion FTA**, while recommended defenses included stronger network segmentation, improved monitoring and logging, offline backups, and exercised OT incident response plans.
Aug 15, 2026
Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT services and took its public website offline, while stating that operational technology (including pipeline control and telecommunications systems) remained functional and oil transport continued. The **Qilin** ransomware group claimed responsibility, and reporting indicated the actor alleged data theft on the order of **~1TB**, publishing purported proof such as internal documents, financial records, and scanned passports on its leak site. Separate reporting described an unrelated cloud-focused cybercrime campaign attributed to **TeamPCP** (aka **PCPcat** / **ShellForce**), which has been compromising exposed and misconfigured cloud management interfaces at scale using automated, worm-like propagation. The activity was assessed as leveraging broad scanning and “industrialized” use of known weaknesses and misconfigurations (rather than novel exploits) to hijack infrastructure and monetize access, with claims of at least **~60,000** servers compromised globally since late December.
Jun 29, 2026