09-05-26, 05:46 PM
Hello DarkForums.
No deal. No response. No ransom paid.
Today I am releasing the complete data extraction from K Subsea Group (ksubsea-group.com) – a Norwegian-Singaporean offshore subsea engineering firm servicing North Sea energy projects. Over 293GB of raw operational intelligence, diver medical records, client commercial bids, and internal submarine inspection data.[reference:0]
What we exploited:
- Unpatched external-facing RDP server with reused corporate credentials
- No MFA enforced on SharePoint document libraries
- Lateral movement via exposed SMB shares containing network backup archives
- Zero network segmentation between operational technology (OT) and administrative systems
- Weak Azure tenant token rotation allowing persistent session hijacking[reference:1]
Database Info:
- Platform: Microsoft SharePoint + NAS Storage + SQL Server
- Organization: K Subsea Group
- Domain: ksubsea-group.com
- Country: Norway / Singapore
- Total Leak Size: 293.44 GB
- Files Count: 142,370
- Ransomware Group: not mentioned
- Date of Attack: April 2026[reference:2]
- Threat Actor Statement: "We have breached K Subsea Group's network and obtained sensitive data. The full leak will be released unless our demands are met."[reference:3]
Compromised Data – K Subsea Group (293GB):
Sample Data (representative intelligence – redacted):
Additional intelligence:
Why this matters:
Deliverables:
Download:
Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/
No deal. No response. No ransom paid.
Today I am releasing the complete data extraction from K Subsea Group (ksubsea-group.com) – a Norwegian-Singaporean offshore subsea engineering firm servicing North Sea energy projects. Over 293GB of raw operational intelligence, diver medical records, client commercial bids, and internal submarine inspection data.[reference:0]
What we exploited:
- Unpatched external-facing RDP server with reused corporate credentials
- No MFA enforced on SharePoint document libraries
- Lateral movement via exposed SMB shares containing network backup archives
- Zero network segmentation between operational technology (OT) and administrative systems
- Weak Azure tenant token rotation allowing persistent session hijacking[reference:1]
Database Info:
- Platform: Microsoft SharePoint + NAS Storage + SQL Server
- Organization: K Subsea Group
- Domain: ksubsea-group.com
- Country: Norway / Singapore
- Total Leak Size: 293.44 GB
- Files Count: 142,370
- Ransomware Group: not mentioned
- Date of Attack: April 2026[reference:2]
- Threat Actor Statement: "We have breached K Subsea Group's network and obtained sensitive data. The full leak will be released unless our demands are met."[reference:3]
Compromised Data – K Subsea Group (293GB):
Quote:- Complete operational archives: technical documentation for diving systems, vessel safety management systems (SMS), real-time maintenance logs
- Extensive tendering history: audited financial statements, commercial proposals, corporate bank account details, pricing models for offshore energy clients
- Comprehensive HR databases: payroll details, visa applications, crew assignment records, expense submissions spanning years
- Highly sensitive personal data of crew members and divers across multiple jurisdictions: full passport scans, medical examination results from offshore fitness tests, emergency contact details, decompression incident records
- Private WhatsApp and Microsoft Teams message archives: internal chats between divers and onshore operations, including safety concerns and equipment failure discussion
- Proprietary operational data: underwater inspection reports from major offshore contracts, infrastructure databases in native AutoCAD .dwg format – complete structural layouts of subsea pipelines and cables
- Confidential client data: master service agreements, liability waivers, technical reviews affecting over 15 major energy and maritime partners
- Client list excerpt: Saudi Aramco, Chevron, Shell, Petronas, Equinor, TotalEnergies, BP, ConocoPhillips, Harbour Energy, Neptune Energy, Aker BP, OMV, Wintershall Dea, Eni, Repsol
- Corporate registry extracts: Singapore ACRA filings, Norwegian Brønnøysundregistrene documents
- Insurance policies: maritime liability insurance schedules, hull and machinery coverage, pollution liability endorsements
- Proprietary diving tables: decompression schedule databases, gas mixture calculations, repetitive dive timetables used for North Sea saturation diving operations
- Black box recordings of diving operations: full dive log telemetry, physiological monitoring data, environmental conditions at depth
- Internal mapping of Black Sea fleet operations: pipeline installation coordinates, cable-lay vessel movements in restricted maritime zones[reference:4][reference:5]
Sample Data (representative intelligence – redacted):
Quote:Quote:
- Employee Medical Record: Diver ID: DIV-043-SG – Medical clearance date: 2025-06-12 – Fitness to dive: YES – Document: "Diver Medical Assessment_North Sea_signed.pdf" – Physician stamp and signature – Previous decompression illness: recorded 2024-08-23.
- Client Contract: Shell – Frame Agreement – Expiry: 2027-09-30 – Scope: "Inspection, repair and maintenance of subsea infrastructure in the North Sea." – Pricing schedule: day rates for dive support vessels and ROV operations.
- AutoCAD File: `NS_Pipeline_Route_Block_32.dwg` – Size: 87 MB – Metadata: "Approved for construction" – Contains GPS coordinates of subsea assets.
- WhatsApp Export (Internal Operations): 2026-03-14 – User: "DiveSup" – Message: "Surface interval insufficient for second saturation dive. Medical refusals incoming. Do not push." – Replied: "Exec confirms. Proceed with postponement notification."
- Corporate Bank Statement: DNB Bank ASA – Account: 1234.56.78900 – Balance: NOK 14,200,000 – Transaction description: "Client retainer – Saudi Aramco" – Date: 2026-02-18.
- Black Box Telemetry: Dive session ID: SAT-2026-0039 – Max depth: 108 meters – Bottom time: 4h 22m – Decompression obligation fully offloaded to surface control.
Additional intelligence:
Quote:- The company was previously listed as a ransomware victim by the Direwolf group in August 2025. Either no remediation was performed or data was re-exfiltrated by a second actor. Same NAS shares. Same weak perimeter.
- Audit trails in the exfiltrated logs indicate exfiltration occurred on April 11–13, 2026, matching the published claim date.[reference:6]
- The database includes historical diving records for 50+ commercial divers currently holding active offshore work passes in Norway, Singapore, and Angola.
- Internal client billing rates are included, referencing Saudi Aramco project ID "KSA-DFO-2024-442" and Shell PSC "SUBS-CON-0992". Competitors can now undercut pricing or recreate proposals verbatim.
- Personal medical data and decompression incident logs represent potential health privacy violations under GDPR and Singapore PDPA. Class action exposure is material.
Why this matters:
Quote:- 293GB of offshore critical infrastructure data
- Subsea pipeline inspection maps in AutoCAD format = targeting intelligence for nation-state maritime operations
- Diver medical assessments and decompression incident records = direct privacy breach of 100+ individual medical files
- Internal WhatsApp logs contain unvetted operational safety admissions
- Black box telemetry from saturation diving operations = competitive edge for rival subsea engineering firms
Deliverables:
Quote:- `K_Subsea_293GB.rar` – full extraction
- Folder structure:
- `/ops/technical_diving/` – manuals, SMS records, diving logs
- `/tendering/proposals/` – commercial bids to Shell, Chevron, Saudi Aramco, Petronas, and others
- `/hr_crew/medical_records/` – passport scans, medical clearance PDFs, decompression incident files
- `/chat_logs/whatsapp_teams/` – operational text archives
- `/cad/autocad/` – .dwg pipeline and infrastructure maps
- `/financial/statements_banking/` – audited financials, corporate bank details
- `/client_data/contracts/` – frame agreements, liability waivers
- `/corporate/insurance_policies/` – maritime policies
- `/black_box/telemetry/` – dive session logs
Download:
Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/
