Conpet Hacked: Infostealer Analysis
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Romania’s Oil Pipeline Operator Hacked: How an Infostealer Infection Paved the Way for Qilin’s Ransomware Attack
<p><strong>February 2026</strong> – The Romanian national oil pipeline operator, <strong>Conpet</strong>, recently <a href="https://www.bleepingcomputer.com/news/security/romanian-oil-pipeline-operator-conpet-discloses-cyberattack-qilin-ransomware/" rel="noreferrer" target="_blank">confirmed a major cyberattack</a>. The notorious <strong>Qilin ransomware group</strong> has claimed responsibility, alleging they have stolen nearly 1TB of sensitive data, including financial records and internal documents.</p>
<p>While the company and authorities investigate, <a href="https://www.hudsonrock.com" rel="noreferrer" target="_blank">Hudson Rock</a> has identified the likely “Patient Zero.” Our analysis reveals that the breach almost certainly originated from a single <strong>Infostealer infection</strong> on a computer belonging to a Conpet IT employee.</p>
<div>
<p><strong>Key Findings:</strong></p>
<ul>
<li><strong>Infection Date:</strong> January 11, 2026 (Weeks before the ransomware deployment).</li>
<li><strong>Detection Date:</strong> January 12, 2026 (Identified by Hudson Rock one day later).</li>
<li><strong>Source:</strong> A personal/side-business computer used by a Conpet IT administrator.</li>
<li><strong>Impact:</strong> The infection leaked critical credentials for VPNs, Network Monitoring (Cacti), and Update Services (WSUS), handing Qilin the keys to the entire network.</li>
</ul>
</div>
<h2>The “Smoking Gun”: A Jan 11th Infection</h2>
<p>Through <a href="https://www.hudsonrock.com/cavalier" rel="noreferrer" target="_blank">Hudson Rock’s Cavalier</a> platform, we identified a computer infected with an Infostealer malware on <strong>January 11, 2026</strong>. Crucially, this data was intercepted and indexed by Hudson Rock on <strong>January 12</strong>, providing early visibility into the threat.</p>
<p>The infected machine, named <code>DESKTOP-TCR5GQM</code>, was logged in under the user <code>GadgetFix</code>. At first glance, this appears to be a personal computer, likely used for a side business involving electronics repair (based on the “GadgetFix” name and associated <code>gadgetfix.ro</code> credentials found in the logs).</p>
<img alt="Raw files retrieved from the infostealer infection" src="https://www.infostealers.com/wp-content/uploads/2026/02/enki1_0.png" />
<p>Figure 1: The raw files retrieved from the infostealer infection.</p>
<img alt="Hudson Rock Intelligence identifying the user" src="https://www.infostealers.com/wp-content/uploads/2026/02/enki1_1-1.png" />
<p>Figure 2: Hudson Rock’s Infostealer Intelligence identifying the Conpet employee behind the infected machine.</p>
<p>However, a deeper look at the <strong>268 credentials</strong> exfiltrated from this single machine reveals its true significance. The user, identified as <strong>******.******</strong> (an IT employee at Conpet), was using this same machine to log into critical Conpet infrastructure.</p>
<h2>The Attack Path: From Infostealer to Ransomware</h2>
<p>Ransomware groups like Qilin rarely “break in” using sophisticated zero-day exploits anymore; they simply log in. The logs from this infection provided a perfect roadmap for a full-scale domain takeover.</p>
<img alt="Overview of sensitive Conpet credentials - Part 1" src="https://www.infostealers.com/wp-content/uploads/2026/02/conpet_creds1-1.png" />
<p>Figure 3: Overview of the critical Conpet credentials identified by Hudson Rock (Part 1).</p>
<img alt="Overview of sensitive Conpet credentials - Part 2" src="https://www.infostealers.com/wp-content/uploads/2026/02/conpet_creds2.png" />
<p>Figure 4: Overview of the critical Conpet credentials identified by Hudson Rock (Part 2).</p>
<p><em>Note: While we cannot forensically confirm the exact commands executed by the attackers, the presence of these specific credentials creates a highly probable “kill chain.” The following visualization demonstrates how an attacker could leverage these stolen logins to move from initial entry to total network compromise.</em></p>
<div>
<div>
<h3>1. Initial Access</h3>
<div>
<strong>The Front Door:</strong> Attackers use Outlook Web App (OWA) to read internal comms and launch phishing from a trusted user.
</div>
<div>
URL: webmail.conpet.ro<br />
User: ******.******@conpet.ro
</div>
</div>
<div>➜</div>
<div>
<h3>2. Reconnaissance</h3>
<div>
<strong>Mapping the Network:</strong> Access to Cacti (Monitoring) reveals server IPs, uptime, and network topology.
</div>
<div>
URL: cacti.conpet.ro<br />
User: monitorizare@it…
</div>
</div>
<div>➜</div>
<div>
<h3>3. Lateral Movement</h3>
<div>
<strong>Game Over:</strong> Compromising the WSUS (Update Server) allows pushing ransomware as a “fake update” to all PCs.
</div>
<div>
URL: conpet-wsus01…<br />
User: ****** / R******
</div>
</div>
</div>
<p>The most critical find in the logs was access to the <strong>WSUS (Windows Server Update Services)</strong> server. In a Windows environment, the WSUS server is trusted by all other computers to provide system updates. <strong>If an attacker controls WSUS, they can push a “fake update” – which is actually the Qilin ransomware payload – to every server and workstation in the company simultaneously.</strong></p>
<table>
<thead>
<tr>
<th>Critical System</th>
<th>URL / Host</th>
<th>Login Found</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Update Server (WSUS)</strong></td>
<td><code>conpet-wsus01.intranet.conpet.ro</code></td>
<td>****** / R******</td>
</tr>
<tr>
<td><strong>Infrastructure/DB</strong></td>
<td><code>wireless-guest.intranet.conpet.ro</code></td>
<td>root / r******</td>
</tr>
<tr>
<td><strong>Asset Management</strong></td>
<td><code>patrimoniu.conpet.ro</code></td>
<td>******.******</td>
</tr>
<tr>
<td><strong>Printer Admin</strong></td>
<td><code>conpet-prt11...:8080</code></td>
<td>admin</td>
</tr>
</tbody>
</table>
<img alt="Qilin Ransomware Group claiming Conpet as a victim" src="https://www.infostealers.com/wp-content/uploads/2026/02/conpettttt.png" />
<p>Figure 5: The Qilin ransomware group listing Conpet on their dark web leak site.</p>
<img alt="Determining role and sensitive access" src="https://www.infostealers.com/wp-content/uploads/2026/02/enki2.png" />
<p>Figure 6: Mapping the specific sensitive accesses revealed in the infection logs.</p>
<h2>The Human Element</h2>
<p>This breach highlights a critical failure in “Shadow IT” and device policy. The machine <code>DESKTOP-TCR5GQM</code> was clearly used for personal projects – the logs show administrative access to side businesses like <code>gadgetfix.ro</code> and <code>compascoffee.ro</code>.</p>
<p>By logging into highly sensitive work accounts (like the Conpet WSUS server) from an unsecured personal device used for downloading random software, the employee inadvertently bridged the air gap between the criminal underground and Romania’s critical energy infrastructure.</p>
<img alt="AI Conclusion" src="https://www.infostealers.com/wp-content/uploads/2026/02/enki3_real.png" />
<p>Figure 7: AI Analysis confirming the severity of the identified breach vector.</p>
<h2>Conclusion</h2>
<p>The Conpet breach serves as a stark reminder: <strong>Infostealers are the precursor to Ransomware.</strong></p>
<p>The gap between the initial infection (Jan 11) and the public disclosure of the ransomware attack (Feb 6) suggests that Qilin had weeks to explore the network using these stolen credentials. Organizations must monitor for compromised credentials of their employees <em>before</em> they are used to deploy ransomware.</p>
<p>To learn more about how Hudson Rock protects companies from imminent intrusions caused by info-stealer infections of employees, partners, and users, as well as how we enrich existing cybersecurity solutions with our cybercrime intelligence API, please schedule a call with us, here: <a href="https://www.hudsonrock.com/schedule-demo" rel="noreferrer" target="_blank">https://www.hudsonrock.com/schedule-demo</a></p>
<p>We also provide access to various free cybercrime intelligence tools that you can find here: <a href="https://www.hudsonrock.com/free-tools" rel="noreferrer" target="_blank">www.hudsonrock.com/free-tools</a></p>
<p>Thanks for reading, <strong>Rock Hudson Rock!</strong></p>
<p>Follow us on LinkedIn: <a href="https://www.linkedin.com/company/hudson-rock" rel="noreferrer" target="_blank">https://www.linkedin.com/company/hudson-rock</a><br />
Follow us on Twitter: <a href="https://www.twitter.com/RockHudsonRock" rel="noreferrer" target="_blank">https://www.twitter.com/RockHudsonRock</a></p>
The post Romania’s Oil Pipeline Operator Hacked: How an Infostealer Infection Paved the Way for Qilin’s Ransomware Attack appeared first on InfoStealers.