The Emirates-focused data leaks were published on the XSS
cybercrime forum on December 28, 2024. QatarGas has recently rebranded as
QatarEnergy LNG. The firm is the largest liquefied natural gas company in the
world. In the context of the Gaza conflict, the listing of sensitive data
connected to this firm is notable and may suggest possible geopolitical
motivations.

QatarEnergy is also in the process of developing a
$5 billion offshore “megaproject” in a large oil field located in the Persian
Gulf, that the Qatari nation jointly owns and shares with Iran.Meanwhile, ANODC
Offshore is the largest offshore oil producer in Abu Dhabi. Bell Energy (The
Bell Group) is also headquartered in Abu Dhabi. The threat actor who leaked
this confidential, Emirates-focused energy data goes by the handle ‘cyberdluffy’
on the XSS forum.

Another noteworthy posting is the Office 365 Exchange access
listing for a U.S. energy firm that generates $6 billion in annual revenue.
This access listing was posted on the XSS forum on October 16, 2024 by a threat
actor who goes by the handle ‘johnsherlock.’ The threat actor listed
this access offering for $15,000 USD.

Notably, Microsoft Office 365 has been aggressively targeted
by nation-state actors like Midnight Blizzard, AKA NOBELIUM.
According to Microsoft threat intelligence analysts,
“Midnight Blizzard is a Russia-based threat actor attributed by the
US and UK governments as the Foreign Intelligence Service of the Russian
Federation, also known as the SVR.” Microsoft also said this “threat actor is
known to primarily target governments, diplomatic entities, non-governmental
organizations (NGOs) and IT service providers, primarily in the US and Europe.”

Analyzing a malicious campaign that targeted Exchange web
services in January 2024, Microsoft noted that threat actors like Midnight
Blizzard “compromise user accounts to create, modify, and grant high
permissions to OAuth applications that they can misuse to hide malicious
activity.” In this campaign, Midnight Blizzard compromised a
legacy test 0Auth application to “grant them the Office 365 Exchange Online
full_access as_app role, which allows access to mailboxes.”

While there is no substantive link between the johnsherlock access
broker persona and Midnight Blizzard, the critical nature of this
type of access listing, combined with the geoeconomically sensitive nature of
the victim’s industry category (energy), and the relatively high price of the
listing, merit closer investigation. If anything, access postings like this
illustrate how the line between financially motivated and nation-state
cyber-threat activity can often be blurry.

The final noteworthy energy-sector access listing observed
by Resecurity is the Breach Forum post that promoted network remote code
execution (RCE) access to the “largest energy company in North Africa.” The
threat actor who posted this listing is Belsen Group, a nascent,
illicit access broker group that gained notoriety in
January 2025 for their leak of “configurations from over 15,000 compromised
FortiGate firewalls.” Belsen Group has been classified by
the cyber threat intelligence (CTI) community as an illicit data broker.

Belsen Group posted their North African energy
sector access listing on February 10, 2025, and priced the offering at $20,000
USD.

Based on the annual revenue information provided by the
threat actor, the alleged victim listed does not appear to be the largest
energy company in North Africa. That distinction belongs to Sonatrach, the
national state-owned oil company of Algeria, which generates over $77 billion
in annual revenue. However, it’s possible Belsen Group misstated
the annual revenue for the victim they were claiming.

Hacktivism

Hacktivism is another leading threat targeting the energy
sector. Hacktivism is the act of staging cyberattacks in the furtherance of
social, political, or ideological change. Most of the geopolitically inspired
hacktivist activity documented since the start of the 2022 Ukraine war has
manifested as low-level DDoS attacks or web defacements.

But over the last year, HUNTER analysts have observed
numerous hacktivist groups claiming successful attacks on energy sector targets
in the furtherance of causes aligned with the Russo-Ukraine war and the Gaza
conflict. Two prominent pro-Russia hacktivist groups that have generated
publicity for their energy-sector targeting, despite general skepticism
regarding their claims, are ‘Z-Pentest’ and its partner
organization, ‘Sector 16’ (S16).

A December 2024 Cyble report noted
that Z-Pentest has “posted videos to their Telegram channels
allegedly showing members tampering with operational technology controls (OT),
most notably in the oil and gas and water system sectors.”

Cyble noted that those claims “may largely be intended to
establish credibility rather than inflict damage on targets.” However, Cyble
expressed alarm that, in December, Z-Pentest’s claims “escalated to
include disrupting one U.S. oil well system.” Notably, Z-Pentest claims
to be based out of Serbia. The group is also aligned with various anti-NATO and
pro-Palestine hacktivist groups.

According to the December Cyble report, Z-Pentest claimed
to have disrupted “critical systems at an oil well site, including systems
responsible for water pumping, petroleum gas flaring, and oil collection.” A
6-minute screen recording posted by the threat actor showed “detailed
screenshots of the facility’s control systems, showing tank setpoints, vapor
recovery metrics, and operational dashboards allegedly accessed and changed
during the breach,” according to Cyble.

In a March 2025 interview with
Spanish cybersecurity firm Miólnir, a spokesperson for Z-Pentest pontificated
on their hacktivist motivations. This interview was facilitated by another
pro-Russia hacktivist group called ‘Noname057(16)’ that we will
elaborate on in the following section.

In the Miólnir interview, the Z-Pentest spokesperson
referenced the disastrous White House meeting between the Ukrainian and
American heads of state, as the commented on the current geopolitical
situation:

“We're always on Russia's side, no need to guess. As for
Zelensky's circus show in the Oval Office, well, he's better at comedy than
military strategy. By the way, we like how Trump mocks the fictional state; at
least he has a sense of humor.

As for Europe's leaders… Well, they're a bunch of lost
people who don't understand who or what they're dealing with. If they think
they're safe, we have to disappoint them: no, they're not. We're everywhere.

Anyone who opposes the Russians is signing a one-way
ticket with no return. We don't care who decided to play with fire; we will
always defend our own and destroy everything that stands in our way. Want to
try your luck? Well, good luck. You'll need it.”

Z-Pentest also denied receiving financial
support from state-sponsored actors, telling Miólnir:

“Every time we hear about being sponsored by a
government, we laugh so hard we snort coffee. We're not dependent on any
country's budget! We have an international crew, and if they made a movie about
us, it would be a real box office hit. We're like a big family, where everyone
truly lives in harmony (well, except for those who always eat the last slice of
pizza).

But if someone decides to support us, say, with a cup of
coffee or something stronger—we won't say no!”

However, since the start of 2025, S16 has been
the most prolific Russia-nexus hacktivist group targeting the energy sector.
Like Z-Pentest, S16 also claims to be based out of
Serbia. Including a joint S16-Z-Pentest attack on the
Supervisory Control and Data Acquisition (SCADA) system managing oil pumps and
storage tanks in Texas, announced in January, S16 has claimed
responsibility for five energy-sector attacks around the world.

In the Texas SCADA attack, S16 claimed the
“system was hacked and completely broken, oil production was stopped, the
system was completely destroyed.” However, these claims remain unverified and
should be treated with skepticism. Hacktivist groups frequently exaggerate the
impact of their breaches to generate hype and spread disinformation. The
now-defunct, Russia-nexus DDoS group KillNet is a prime
example of this modus operandi.

Beyond the U.S., the group has targeted energy firms in
France and Germany. The group’s most recent energy-sector attack claims
centered on German “process cooling and refrigeration” firm GEA. The company’s
website notes that “GEA’s process refrigeration and gas compression
technologies have demonstrated reliable performance in oil & gas, chemical,
petrochemical,” and other applications.

On February 9, S16 announced on their
official Telegram channel that they had “attacked the automated control system
of the equipment for the natural gas cooling system of the company GEA
." S16 also claimed the attack was enabled by human
error, as “access was obtained by easy brute force of the server,” which
allowed the hacktivists gain “full access to the system and its control.”

S16 has also been observed partnering with
Russia-based hacktivist group OverFlame to target energy
facilities. In January, S16 announced they collaborated with OverFlame to
attack the “hydroelectric power plants of France, the company
"DYNELEC" in the city of Maser-sur-Salat!”

(PICTURE WOULDN'T LOAD TO THIS, SOMETHING IN THE PICTURE THE CASES SYSTEM DOESN'T LIKE)

The threat actors claimed the attack inflicted the following
cyber-physical damage: “The valves were broken, the seals were damaged by
increasing the pressure, the server failed, the flow power in the group
settings was increased, which will inevitably lead to wear of the equipment and
strategically important parts for work.” Again, these claims remain unverified.

On the Gaza front, leading anti-Israel hacktivist groups
engaged in this conflict include ‘CyberAv3ngers’ and ‘Handala.’
Both threat actor groups have been observed targeting the energy sector. A
Cybersecurity & Infrastructure Security Agency announcement that was last
revised in December 2014 advisory described CyberAv3ngers as
a persona used by threat actors affiliated with the Iranian Government’s
Islamic Revolutionary Guard Corps (IRGC).

The CISA advisory noted how CyberAv3ngers’ malicious
campaigns began in November 2023, just one month after the October 7 massacre.
Around this time, these IRGC-affiliated threat actors “began actively targeting
and compromising Israeli-made Unitronics Vision Series programmable logic
controllers (PLCs) and human machine interfaces (HMIs),” according to CISA.

CISA also noted that CyberAv3ngers left
defacement images on victim websites stating, “You have been hacked, down with
Israel. Every equipment ‘made in Israel’ is CyberAv3ngers legal target.” PLCs
targeted in this attack campaign are “commonly used in the Water and Wastewater
Systems (WWS) Sector and used in other industries including, but not limited
to, energy, food and beverage manufacturing, transportation systems, and
healthcare,” according to CISA.

Again, CyberAv3ngers’ targeting activities
highlight the unique supply-chain threat that energy sector firms face,
particularly in the context of external geopolitical conflicts. In this
IRGC-nexus campaign, for example, all critical digital assets (CDAs)
manufactured by Israel have been deemed legitimate military targets, thus
threatening enterprise customers of these products with potentially
catastrophic collateral damage.

Handala is another prolific Gaza-nexus threat
actor that has attracted the attention of the CTI community for their bold
claims of energy sector hack-and-leak operations and similar campaigns in other
sectors. Regionally, Handala’s targeting has been focused on
Israeli entities.

In a July 2024 CTI report documenting a Handala wiper
malware campaign that opportunistically exploited the widespread CrowdStrike
Falcon outage,
Trellix said the group “at least pretends to act based on pro-Palestinian
motives,” but cautioned this posturing could be a “façade for an ulterior
motive.” This assessment is common for most high-level hacktivist activity,
which can easily serve as cover for nation-state espionage or disinformation
operations.

Energy sector victims allegedly compromised by Handala include:

• BLEnergy
  – a leading battery energy storage systems (BESS) integrator and provider
  in Israel


• ELitech
  - a company providing engineering and project management services to
  renewable energy, private power plants, gas insulated substations (GIS),
  defense and military projects, and projects requiring a high degree of
  technological expertise

In July 2024, Handala published a post on
the RAMP cybercrime forum announcing that the hack and leak of 145 GB of data
belonging to BLenergy. This attack again highlights the growing threat to
companies that operate in the renewable energy space.

Highlighting related supply-chain risks and targeting, Handala’s
post noted that exactly one month prior to their claimed attack, “CATL signed a
billion dollar contract with BLEnergy.” “CATL is the leading battery
manufacturer in the world in the fields of electric vehicles and energy
storage,” according to Handala’s post.

Handala also warned the victim to “think about
the consequences of cooperation in our occupied lands and do not try our
patience more than that! We will leak all the data! Our backdoor is still
active in hundreds of Zionist companies, so we are looking for the right
opportunity to attack!”

In April 2024, the threat actor also announced on the RAMP
forum that they had hacked and leaked 4.9 terabytes of data belonging to
Elitech. Notably, this attack included the hashtags #OpIsrael and #OpJerusalem.
Resecurity has previously chronicled #OpIsrael-related hacktivist campaigns that
ensued in the wake of the October 7 massacre.

Nuclear Access and Data Leaks

Alarmingly, threat actors have also escalated their
targeting of the nuclear sector. These attacks have ranged from intricate job
recruitment and phishing schemes targeting nuclear sector personnel to
allegations of stolen data, access listings, and claims of successful DDoS
attacks.

Over the last year, the most notorious adversary confirmed to
have attacked nuclear sector targets is Lazarus Group, a North
Korean state-backed advanced persistent threat (APT) group that has gained
infamy for its high-ticket crypto hacks. In December 2024, Kaspersky documented
their findings from a Lazarus campaign they dubbed “Operation
DreamJob.”

An investigation conducted by Kaspersky revealed that
several employees from a nuclear-related organization were “infected via three
compromised archive files appearing to be skill assessment tests for IT
professionals.” This ongoing campaign “leverages a range of advanced malware,
including a newly discovered modular backdoor, CookiePlus, that was disguised
as open-source plugin,” according to Kaspersky.

(PICTURE WILL NOT LOAD)

Framatome “designs, manufactures, and installs components,
fuel and instrumentation and control systems for nuclear power plants and
offers a full range of reactor services,” according to the company’s Wikipedia
page.

Noname057(16) claimed to have conducted two more
nuclear sector DDoS attacks on April 1, 2025. These attacks allegedly impacted
the public-facing websites targets in Belgium: Doel and Tihange. The facilities
represent half of
Belgium’s four nuclear reactors, according to the World Nuclear Association.

(PICTURE WILL NOT LOAD)

It is unclear how effective or impactful Noname057(16)’s
DDoS attacks on these three nuclear targets were. However, it should be noted
that there was no risk to the proper functioning of OT and related critical
digital assets (CDAs) in the nuclear facilities publicly shamed by the threat
actor.

The primary reason it is extremely difficult to compromise
or otherwise disrupt nuclear power operations through cyber-enabled means is
that these energy facilities mandate the implementation of air-gapped networks
by default. This means that industrial control systems (ICS), SCADA
infrastructure, and other CDAs are physically isolated from the external
networks, including the public Internet.

Additionally, these facilities enforce extremely strict
network segmentation between business IT and physical OT networks. In theory,
this framework makes lateral movement from a compromised IT system into an OT
environment impossible. Furthermore, the data flow in nuclear energy facilities
is designed to be unidirectional by default. This mean that data can only flow
out of the plant environment, while no data is allowed to enter the facility’s
network.

According to Mark Rorabaugh, the President of InfraShield, a
critical infrastructure security firm with unique expertise in protecting
nuclear power facilities, the primary risk to these entities emerges from
physical sabotage conducted by malicious insiders. “The specific attack vector
that nuclear energy operators must be on high alert for is malicious portable
media introduced into the plant environment by a rogue employee or contractor,”
according to Rorabaugh.

Nevertheless, while Noname057(16)’s attacks are
relatively unsophisticated, HackManac highlighted them
as the most active threat group for the week dated March 19-25 2025. The threat
group accounted for 135 of 574 confirmed cyberattacks that week, illustrating
their significant level of threat activity. The group’s second-degree (and
perhaps more expansive links) to S16 is also a nexus
nuclear-sector defenders should monitor closely, given the latter’s alarming
and increasing claims of successfully compromising OT and SCADA systems.

Significance

Resecurity’s second energy-sector CTI report documents the
HUNTER unit’s latest findings of malicious activity targeting these critical
infrastructure organizations. In a geopolitical backdrop fractured by ongoing
conflicts in Ukraine and Gaza, HUNTER’s findings largely demonstrate how
military hostility is projected into cyberspace and how ancillary cybercriminal
ecosystems support the malicious targeting of energy firms.

For energy-sector defenders, the findings of this report
should serve as a warning that threat actors are escalating their attacks on
these critical infrastructure organizations and growing increasingly bolder
when it comes to targeting their OT networks. In this threat landscape, the
potential for a catastrophic cyber-physical attack that causes environmental or
human harm is rapidly increasing.

The most prominent threat actors recently identified by
HUNTER as actively targeting the energy sector include the following:

• RansomHub/DragonForce [Ransomware]


• HellCat [Ransomware]


• Lazarus
  Group [Nation-State]


• Cyb3rAv3ngers [Nation-State]


• S16 [Hacktivist]


• Noname057(16) [Hacktivist]

Based on this compilation of leading threat actors,
defenders should be especially aware of HellCat’s tactics,
techniques, and procedures (TTPs), specifically their reliance on infostealer
attack chains, with an emphasis on Lumma malware. Given this targeting
activity, defenders should regularly conduct comprehensive dark web monitoring
to audit their personnels’ and IT/software supply-chain partners’ exposure to
credential compromise. The latter is particularly vital as SecurityScorecard
and KMPG research revealed that the IT and software supply chain is the energy
sector’s weakest link.

Conclusion

In response to these growing threats, the U.S. Department of
Energy (DOE) issued new cybersecurity guidelines for electric
distribution systems and distributed energy resources (DER) in 2024. These
guidelines, developed in collaboration with the National Association of
Regulatory Utility Commissioners (NARUC), aim to provide a common framework for
reducing risk and improving the cyber resilience of critical infrastructure.

Resecurity warns about the increase in targeted cyberattacks
against enterprises in the energy sector worldwide. Some of these attacks
represent much larger campaigns designed to target country-level
infrastructure, acting as tools for geopolitical influence. It is expected that
nation-state actors and foreign intelligence will leverage this approach as a
new generation of warfare in the future, where the role of cybercriminal actors
may be significant, enabling further cyberattacks and providing infrastructure
and resources to conduct offensive cyber operations.