logo

Netfilim Ransomware Leaks W&T Offshore Data Part 2

ID: e4896d79-a89e-5a79-8006-5bd60f0c3e26

STIX ID: report--e4896d79-a89e-5a79-8006-5bd60f0c3e26

Feed Name: Cyble Blog

Threat Score
70/100

Date Published: 2025-11-26

Date Updated: 2026-07-17

...
...

Cyble verified that the Netfilim (Nefilim) ransomware operators published part 2 of stolen data from W&T Offshore — roughly 4 GB of sensitive and financial documents (tax returns, tax provision documents, partnership agreements, audit reports, etc.). The report notes this followed an earlier leak published on 27 April 2020 and that additional leak parts were released later, framing the activity as an ongoing ransomware extortion/data-leak campaign targeting the company.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.