Oil & Gas

Activity Summary - Week Ending 01 March 2019:

• Wapack Labs identified 243 unique email accounts compromised with keyloggers
• 72,499 connections from new unique IP addresses were identified
• Wapack Labs identified 851,100 new IP addresses participating

Activity Summary - Week Ending 22 February 2019:

• Wapack Labs identified 59,921 connections from new unique IP addresses
• Top email keylogger at: Al Shirawi Enterprises LLC, UAE
• Wapack Labs proprietary sources identified 637,094 new IP addresses parti

Activity Summary - Week Ending 15 February 2019:

• Wapack Labs identified 53,521 connections from new unique IP addresses
• GandCrab Ransomware Campaign is exploiting DNS Systems
• Operation Extreme Job and APT Lazarus
• Do the Climate Change Campaigns Matt

Summary

Three (3) oil and gas (Energy) sector companies were the target of attempted phishing campaigns from a Malawi, Africa identified malicious domain.

Virus Total identified malicious domain:[1]
etcay.org domain information:

Description: Economic

Activity Summary - Week Ending 8 February 2019:

• Wapack Labs identified 76,207 connections from new unique IP addresses
• choongstephen29@gmail.com is a pwned Gmail from: Stephen Choong, Boten Laos
• Top C2 IP in keylogger collection IP: 104.131.68.41, a

Activity Summary - Week Ending 1 February 2019:

• avitgap4@mail.com is a spoofed email from 1&1 Internet AG and may be a money transfer lure
• Wapack Labs proprietary sources identified 2,262,678 new IP addresses in various botnets
• Wapack Labs’s additio

Activity Summary - Week Ending 25 January 2019:

• Wapack Labs proprietary sources identified 237,434 new IP addresses participating in various botnets
• 66,712 connections from new unique IP addresses were checking in with our sinkholed domains
• Plugin.D

The oil and gas sector is looking to cyber technology solutions for better protection and efficiency.  Compounding the situation are the recent extreme price fluctuations.    While these technology decisions are with good intentions, many industry ex

Activity Summary - Week Ending 11 January 2019:

• Wapack Labs 2019 Cyber Security Threat and Vulnerability Predictions
• Proprietary sources identified 496,877 new IP addresses participating in various botnets
• Wapack Labs identified 187 unique email acc

Activity Summary - Week Ending 4 January 2019:

• Wapack Labs identified 85,263 connections from new unique IP addresses
• Proprietary sources identified 635,965 new IP addresses participating in various botnets
• cz is a web portal and search engine in th

Activity Summary - Week Ending 28 December 2018:

• Wapack Labs proprietary sources identified 763,175 new IP addresses participating in various botnets
• A Laotian Tourism email was the top compromised email
• Asian auto dealerships are being targeted by

Activity Summary - Week Ending 14 December 2018:

• Top observed keylogged email: gatinhogabriel122@gmail.com is a spoofed email
• Wapack Labs identified 90,371 connections from new unique IP addresses
• Proprietary sources identified 1,095,217 new IP addr

Activity Summary - Week Ending 30 November 2018:

• The Attack-Server (C2) vantage.5o8@gmail.com is a marked increase in collection efforts
• Wapack Labs proprietary sources identified 1,256,138 new IP addresses
• Metamorfo Banking Trojan
• L0RDIX: Multipurp

Activity Summary - Week Ending 21 November 2018:

• Thailand Printing Company being spoofed to send malicious emails
• Wapack Labs identified 1033 unique email accounts compromised with keyloggers
• The Name of a Famous Soccer player from Algeria is being

Activity Summary - Week Ending 16 November 2018:

• Spoofed email through the Russian Yandex Service Remains on top of collections
• Wapack Labs identified 530 unique email accounts compromised with keyloggers
• myLoc, managed IT AG, Dusseldorf, Nordrhein-

Activity Summary - Week Ending 9 November 2018:

• Top Keylogged email is from a Taiwanese Mobile Gaming Platform
• Wapack Labs identified 574 unique email accounts compromised with keyloggers
• Wapack Labs identified 59,877 connections from new unique IP

• Katanga Engineering, in Republic of the Congo, Africa is being spoofed
• Sality and Corkow remain the top malware variants
• Wapack Labs identified 68,383 connections from new unique IP addresses
• Wapack Labs sources identified 1,225,605 new IP addresses

• Indonesian food and beverage provider Keylogged
• Infium UAB, Kiev Ukraine – Compromised IP
• Avalanche Botnet+vawtrak and Conficker seen as botnets
• APT Muddy Waters Cyber Campaign – At it Again
• WP.Mobile.Detector.Arbitrary.File.Upload – Mobile Detector