Criminals attacked Croatia's largest oil company

Cybercriminals attacked the largest oil company INA Group in Croatia. During the cyber attack, the attackers allegedly used the CLOP ransomware, which encrypted the data of some of the company's internal servers, ZDNet reported.

This incident did not affect the supply of gasoline to customers and did not affect the performance of the company's payment systems. However, as a result of the attack, the company was unable to issue invoices, record the use of loyalty cards, issue new mobile vouchers and new electronic vignettes, and also accept payment from customers for fuel.

Although the INA Group did not disclose details about what malware was used in the attacks, it is assumed that this is a CLOP ransomware. Several factors testify to the involvement of the ransomware. In particular, a few hours before the INA Group published a statement about the incident, an analyst at Sophos announced the start of activity of the new C&C server used in CLOP cyber attacks. In addition, this week, security researchers discovered new versions of the CLOP ransomware virus on the VirusTotal service.

Recall this week SecurityLab wrote about cyber attacks is, in the US operator of the gas pipeline, which resulted in its computer networks have been infected extortionate software. Attackers used a phishing link to gain initial access to the organization’s information computer networks, and then targeted the OT network (Operational Technology).