Ankura CTIX FLASH Update - December 20, 2022

Malware Activity

Colombian Energy Provider Empresas Públicas de Medellín Suffers ALPHV Ransomware Attack

Empresas Públicas de Medellín (EPM), one of Colombia's largest public energy, water, gas, sanitation, and telecommunication providers, suffered a ransomware attack on December 12, 2022, by the ALPHV ransomware group (otherwise known as BlackCat). The attack shut down their online services and disrupted operations. EPM is currently investigating what infrastructure/information was accessed during the ransomware attack and has yet to disclose the threat group responsible. Bleeping Computer, however, has reviewed the encryptor sample and ransom notes from the EPM attack and confirmed that ALPHV was responsible. The ransom note did not have any specifics about EPM data that may have been exfiltrated, presumptively because this threat actor typically does not convey the exact downloaded data in ransom notes. Security researcher Germán Fernández noted that a sample