PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In April 2020, attackers used a plausible Enppi bid request tied to a real Egyptian oil-and-gas project to lure industry recipients into opening attachments that delivered Agent Tesla spyware, according to Bitdefender Labs. The timing before OPEC+ oil-production discussions raised the possibility of intelligence gathering, but the reporting did not identify the operators, prove a state sponsor or confirm specific victims’ losses.
How the Enppi bid-request lure worked
The email impersonated Engineering for Petroleum and Process Industries (Enppi), an Egyptian engineering contractor. It presented a request for bids on equipment and materials for the Rosetta Sharing Facilities Project on behalf of Burullus. Because the project and counterpart were real, the message could sound credible to people familiar with oil-and-gas work.
Bitdefender’s analysis said the attached archives carried executable files that dropped Agent Tesla, a spyware tool capable of keylogging and collecting credentials and other sensitive information. That describes the malware’s capabilities; the reporting does not establish that particular credentials were stolen from named organizations. Bitdefender also listed an email server used for command and control, but did not document specific operational damage to confirmed victims. Bitdefender Labs’ technical analysis was published April 21, 2020.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →“To someone in the oil & gas industry, who has knowledge about these projects, the email and the information within might seem sufficiently convincing to open the attachments.”
#1 Best Overall
That assessment, from Bitdefender analyst Liviu Arsene, underscores why a specific and accurate business context can make a phishing message persuasive. A familiar project name is not proof that a bid request is genuine; recipients should verify unusual attachments and requests through a trusted contact channel.
A separate shipping-themed operation
Bitdefender also described a related but distinct spearphishing operation that impersonated a shipping company. Its lure used details about the chemical/oil tanker MT Sinar Maluku and maritime terminology, rather than the Enppi project bid.
| Operation | Impersonation and lure | Reported evidence |
|---|---|---|
| Enppi bid request | Egyptian engineering contractor; equipment and materials bid tied to the Rosetta Sharing Facilities Project and Burullus | Archives contained executables that dropped Agent Tesla; the sources do not provide a confirmed-infection count |
| Shipping-themed operation | Shipping company; tanker details and maritime language concerning MT Sinar Maluku | Bitdefender reported 18 telemetry reports on April 13, 2020, 15 associated with shipping companies in the Philippines; these are not confirmed successful infections |
Bitdefender said the shipping activity began around April 12. The 18 reports and the 15 Philippine shipping-company associations indicate detections in vendor telemetry, not a verified roster of compromised companies.
Recommended Free Tools
What the targeting data does—and does not—show
Bitdefender reported activity involving energy-related organizations in Malaysia, the United States, Iran, South Africa, Oman and Turkey. These observations come from the vendor’s telemetry and should not be read as a complete list of targets or confirmed victims. The same report cited more than 5,000 malicious reports from companies operating in the energy industry in February 2020 as part of a broader sector trend. That figure is not a count for the Enppi campaign.
Rank #3
Neither the campaign-specific number of successful infections nor resulting losses was established in the available reporting. A detection, a targeted email and a successful compromise are different events.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why OPEC+ was part of the story
CyberScoop placed the activity in the weeks before OPEC+ and G20 oil-production discussions, amid a dispute over oil-market conditions. The timing and energy-sector targeting prompted speculation that attackers might have wanted intelligence about national or industry positions. That remains an inference: the reports do not establish the campaign’s motive, identify an operator or prove government sponsorship. CyberScoop reported that the researchers did not speculate about who was behind it.
Contemporaneous coverage by CyberScoop and The Register likewise framed the incident around its timing and apparent intelligence interest without confirming who was responsible or what attackers obtained.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
