Mexican state-owned oil company Pemex hit by ransomware

On Sunday, the Mexican state-owned oil company Petróleos Mexicanos (Pemex) was infected with the DoppelPaymer ransomware.

On Sunday, a piece of the DoppelPaymer ransomware infected systems of the Mexican state-owned oil company Petróleos Mexicanos (Pemex) taking down part of its network.

The ransom amount for Pemex is 565 BTC currently…
Also, DoppelPaymer's TOR site's text was updated sometimes & now have this:
"Also, we have gathered all your private sensitive data.
So if you decide not to pay, we would share it.
It may harm your business reputation."
🤔 pic.twitter.com/BoHi1lVigF

— MalwareHunterTeam (@malwrhunterteam) November 12, 2019

According to the company, less than 5% of the computers in its network were infected with ransomware.

Threat actors demanded a $4.9 million (565 BTC) ransom in order to decrypt their files, they are also threatening to leak sensitive data stolen by the company.

“Pemex’s internal network, like all major national and international government and financial companies and institutions, frequently receives threats and cyber attacks that have not prospered today.” reads a security notice published by the company. “Yesterday, Sunday, November 10, the State productive company received attempts at cyber attacks that were timely neutralized, affecting the operation of less than 5% of personal computer equipment. Notwithstanding the foregoing, Pemex reiterates that the production, supply and inventories of fuel are guaranteed.”

The Petróleos Mexicanos claims that it has quickly neutralized the attack, it also highlighted that operation and production systems were not impacted.  

📌Pemex opera con normalidad. pic.twitter.com/IF7kf6VIEk

— Petróleos Mexicanos (@Pemex) November 12, 2019

Pemex confirmed that its infrastructure, like all major national and international government and financial organizations, is under unceasing targeted attacks, for this reason, it is continuing to improve its security measures.

The DoppelPaymer ransomware is a forked version of the BitPaymer ransomware likely developed by some members of the cybercrime gang tracked as TA505.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – ransomware, Petróleos Mexicanos (Pemex))

[adrotate banner=”5″]

[adrotate banner=”13″]