Loading story…
A cyberattack on German fuel logistics operators Oiltanking and Mabanaft, both subsidiaries of Marquard & Bahls, disrupted terminal operations and inland fuel supply, forcing companies including Shell and BP Aral to reroute deliveries and rely on alternative depots. Oiltanking said it detected the incident on January 29, after which some terminals operated at limited capacity and both firms declared force majeure for affected activities. Germany’s BSI described the case as serious and said the disruption affected fuel stations in northern Germany, with some sites reportedly switching to manual processes.
An internal BSI report later attributed the intrusion to BlackCat (also tracked as ALPHV), a Rust-based ransomware-as-a-service operation that emerged in late 2021 and targets both Windows and Linux environments. Security research linked BlackCat to earlier BlackMatter activity through shared tooling such as the Fendr/ExMatter exfiltration utility and overlapping tactics used in double-extortion campaigns, extending a lineage that researchers and U.S. authorities have also associated with DarkSide rebranding. The incident underscored how ransomware operations tied to that ecosystem continued to affect critical supply chains despite public claims by predecessor groups that they would avoid oil and gas targets.
TTPs, infrastructure, and targeting history in one profile.
15 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a threat assessment on BlackCat ransomware, documenting its Rust-based malware, affiliate model, and ransom practices. The report described BlackCat as a newly emerged ransomware-as-a-service group.
A prominent Korean manufacturing company suffered a DarkSide ransomware infection affecting many internal systems in January 2022. AhnLab later found the ransomware had been distributed through Active Directory Group Policy.
Kaspersky researchers found BlackCat extensively used a modified version of the Fendr, or ExMatter, exfiltration tool to steal corporate data before encryption. The activity was observed during December 2021 and January 2022 and linked BlackCat to prior BlackMatter operations.
Unit 42 reported that BlackCat, also known as ALPHV, emerged in mid-November 2021 as a ransomware-as-a-service operation. The group used a Rust-based encryptor and targeted both Windows and Linux systems.
CISA, the FBI, and the NSA released a joint advisory detailing BlackMatter's tactics, ransom demands, targeting, and mitigations. The advisory said BlackMatter had been targeting U.S. critical infrastructure since July 2021 and may be a DarkSide rebrand.
Starting in July 2021, BlackMatter targeted multiple U.S. critical infrastructure entities, including two organizations in the Food and Agriculture Sector. This marked the group's early operational activity documented by CISA, FBI, and NSA.
BlackMatter began operating as a ransomware-as-a-service group in July 2021, according to later U.S. government reporting. The group was assessed as a possible rebrand of DarkSide.
Kaspersky researchers reported new evidence connecting BlackCat to BlackMatter, including BlackCat's reuse and modification of the custom exfiltration tool Fendr/ExMatter. The findings added to earlier observations of overlap between the two ransomware operations.
An internal BSI report obtained by Handelsblatt said the BlackCat ransomware group was behind the cyberattack on Oiltanking and Mabanaft. The report said Oiltanking's systems were compromised through a previously unknown gateway.
Germany's Federal Office for Information Security said it was providing expertise on the incident, and its president Arne Schönbohm described it as serious but not grave. He said 233 fuel stations in northern Germany were affected.
Shell rerouted oil supplies to alternative depots, while BP's Aral network sourced fuel from alternative supplies after the attack disrupted Oiltanking operations. Reuters reported the measures as part of the response to the German fuel logistics outage.
Following the January 29 incident, Oiltanking terminals in Germany operated with limited capacity and both Oiltanking and Mabanaft declared force majeure for affected operations. The disruption affected fuel distribution in northern Germany and forced some stations to use manual processes.
Oiltanking and Mabanaft discovered a cyberattack that disrupted IT systems and supply-chain operations. Oiltanking said it detected the initial incident on January 29 and began working with external specialists and authorities.
Operators linked to DarkSide and BlackMatter moved about 107 BTC, valued at roughly $6.8 million, and split the funds across multiple wallets. Profero assessed the movement as preparation for laundering or cashing out rather than a law enforcement seizure.
In an interview, a BlackMatter representative said the group had developed its ransomware over six months, was recruiting affiliates, and had already attacked companies not yet publicly listed. The group also claimed it would avoid sectors such as healthcare, critical infrastructure, oil and gas, and government.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
asec.ahnlab.com
Open sourcethehackernews.com
Open sourcereuters.com
Open sourceunit42.paloaltonetworks.com
Open sourcezdnet.com
Open sourcetherecord.media
Open sourceus-cert.cisa.gov
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported that **BlackCat** (also tracked as **ALPHV**) shares infrastructure, tools, filenames, and intrusion tradecraft with the **BlackMatter/DarkSide** ransomware ecosystem, indicating with moderate confidence that at least one BlackMatter affiliate became an early BlackCat operator rather than the group being a simple rebrand. In side-by-side intrusions, Talos observed similar human-operated attack phases including persistent access through tunneling tools, credential theft via **LSASS** dumping, lateral movement with **Impacket `wmiexec`**, **WinRM/PowerShell**, and **RDP**, and domain-wide ransomware deployment from the domain controller’s **NETLOGON** share after scripts such as `apply.ps1`, `defender.vbs`, and `def.vbs` were staged. Talos said BlackCat dwell time exceeded 15 days in one case and noted that more than 30 percent of observed compromises affected U.S.-based organizations. Other reporting and technical analyses describe BlackCat as a **Rust-based ransomware-as-a-service** platform that emerged in late 2021, recruited affiliates from groups including **REvil, BlackMatter, and DarkSide**, and offered operators roughly **80 to 90 percent** of ransom proceeds. Researchers said the malware targets **Windows, Linux, and VMware ESXi** environments, uses double extortion with Tor-based payment portals, and includes capabilities such as **CMSTPLUA** privilege escalation, shadow-copy deletion, service and process termination, and configurable encryption using embedded keys. The overlap with DarkSide-era techniques is reinforced by prior DarkSide analyses showing similar affiliate-driven operations, extortion infrastructure, and malware behaviors, supporting the view that BlackCat grew out of the same criminal talent pool rather than appearing as an entirely separate threat.
Aug 15, 2026
A ransomware attack on Colonial Pipeline’s IT environment forced the company to temporarily halt pipeline operations, causing fuel supply disruptions across parts of the United States. Dragos said with high confidence that the **DarkSide** ransomware group was responsible for the compromise and described the incident as the most disruptive cyber intrusion it had seen affecting U.S. energy infrastructure. The shutdown highlighted how closely linked IT and OT environments can be in industrial organizations, allowing an enterprise-system intrusion to trigger major operational consequences. As Colonial Pipeline restarted service, U.S. officials warned that fuel availability would recover gradually and urged the public not to panic-buy gasoline or accept price gouging. The FBI said the Russian government was not behind the attack, though the perpetrators were believed to be operating from Russia. Reporting on the incident also pointed to common ransomware entry paths, including weak passwords on internet-exposed services and exploitation of devices such as **Pulse Connect Secure**, **Fortinet FortiOS**, and **Accellion FTA**, while recommended defenses included stronger network segmentation, improved monitoring and logging, offline backups, and exercised OT incident response plans.
Aug 15, 2026
BlackCat/ALPHV affiliates carried out targeted double-extortion attacks by stealing data and deploying ransomware across Windows, Linux, and VMware ESXi environments, using a Rust-based payload that supports extensive customization. Reporting from Microsoft, Netskope, and Forescout shows the group gaining initial access through several routes, including compromised RDP credentials, exploitation of an unpatched Exchange server, an Internet-exposed SonicWall firewall, and a contractor account compromised via a malicious browser extension that led to virtual desktop access without MFA. After entry, operators escalated privileges, enumerated domains and devices, dumped credentials, and moved laterally with legitimate tools such as **PsExec** before staging broad encryption operations. In one analyzed intrusion, attackers used a compromised domain account to push the **ExMatter** exfiltration tool and the BlackCat payload to more than 2,000 machines, with ExMatter collecting selected file types and sending them over WebDAV to attacker-controlled infrastructure. Researchers also documented BlackCat features including self-propagation via NetBIOS discovery, shadow copy deletion, service termination, event log clearing attempts, and ESXi-specific actions such as stopping virtual machines and deleting snapshots. Separate technical analysis and tooling published by defenders showed that BlackCat binaries embed configurable options for ransom notes, propagation, encryption behavior, and virtualization-focused disruption, underscoring how affiliates adapt the malware to different victim environments.
Aug 15, 2026