Everest Ransomware Strikes Volt Infrastructure in Cyberattack
Everest Ransomware Group Targets Volt Infrastructure in Major Cyberattack
Volt Infrastructure, a prominent Italian company specializing in solar energy infrastructure, has fallen victim to a significant ransomware attack allegedly orchestrated by the Everest ransomware group. This breach underscores the vulnerabilities faced by companies in the renewable energy sector, particularly those with substantial data assets and international operations.
Company Profile: Volt Infrastructure
Volt Infrastructure is a key player in the European renewable energy market, focusing on the development and management of large-scale solar photovoltaic (PV) and battery energy storage systems. Headquartered in Rome, Italy, the company is known for its comprehensive approach to solar projects, which includes project origination, acquisition, development, construction, management, and financing. Despite being a privately held company with a relatively small team, Volt Infrastructure has established a significant market presence, generating substantial revenue through its strategic initiatives and effective business practices.
Details of the Ransomware Attack
The Everest ransomware group claims to have infiltrated Volt Infrastructure's internal network, exfiltrating approximately 526 GB of sensitive data. This data reportedly includes internal documents, confidential information, and contract details crucial to Volt's operations in solar power and energy storage. The breach was discovered on January 16, 2025, with the attackers setting a ransom deadline for January 26, 2025. Everest has urged Volt Infrastructure to make contact through specified channels before the deadline, threatening to expose critical information if their demands are not met.
About the Everest Ransomware Group
The Everest ransomware group, active since December 2020, is known for its double extortion tactics, encrypting victim data while threatening to leak sensitive information. Initially targeting the healthcare sector, Everest has evolved into an Initial Access Broker, selling unauthorized network access to other ransomware groups. Their sophisticated operational tactics include lateral movement, credential access, and data exfiltration, often utilizing tools like Cobalt Strike for command and control communications.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!