Experts named the main target of the hackers attacking the fuel and energy company

Energy entered the top 10 most attacked industries in 2024. This is stated in the results of BI.ZONE's "Threat Zone 2025" study, which was reviewed by Izvestia on April 8. Of the attacking groups, more than half are aimed at espionage.

Experts noted that in recent months, the second spy cluster, Sapphire Werewolf, disguises phishing as letters from recruiters that it sends to fuel and energy companies.

The company clarified that usually clusters of activity acting for espionage purposes are masqueraded as recruiters extremely rarely — in less than 1% of all cases. As a rule, cyber spies prefer to write to their victims on behalf of regulators and other government organizations. However, the current campaign is the second in a short time when spies pretend to be HR specialists.

Confuse the Networks: software failures at the end of the year were most frequently recorded in retail and logistics

Difficulties arise from the departure of software vendors and increased attacks, experts say

In February 2025, experts discovered that hackers had tried to break into the energy company's IT infrastructure to covertly collect data.

"By sending phishing emails disguised as memos from the HR department, they delivered an improved version of the Amethyst styler to the victim's computer. With its help, the attackers could extract authentication data from Telegram, browsers, remote desktop configuration files, and various types of documents," said the head of BI.ZONE Threat Intelligence Oleg Skulkin.

In 2024, the same cluster attacked Russian organizations from the fields of education, IT, the military-industrial complex and the aerospace industry, using modified malicious software called SapphireStealer to steal data.

Earlier, on April 5, Alexander Bykov, head of security services at Nubes cloud provider, told Izvestia that only 8-12% of information losses are due to company employees. More than 85% of data leaks from companies are not the fault of employees, but the deliberate work of intruders attacking businesses.