Empresas Públicas de Medellín (EPM), one of Colombia’s largest public energy, water, gas, sanitation, and telecommunication providers, suffered a ransomware attack on December 12, 2022, by the ALPHV ransomware group (otherwise known as BlackCat). The attack shut down their online services and disrupted operations. EPM is currently investigating what infrastructure/information was accessed during the ransomware attack and has yet to disclose the threat group responsible. Bleeping Computer, however, has reviewed the encryptor sample and ransom notes from the EPM attack and confirmed that ALPHV was responsible. The ransom note did not have any specifics about EPM data that may have been exfiltrated, presumptively because this threat actor typically does not convey the exact downloaded data in ransom notes. Security researcher Germán Fernández noted that a sample of “ExMatter”, a tool utilized by ALPHV to exfiltrate data from corporate networks prior to encryption, was uploaded from Columbia to a malware analysis website on December 10, 2022. Fernández identified a remote server that was not secured and allowed users to view the data stored on it. At the time of his analysis, the server contained multiple folders beginning with “EPM-” and roughly forty (40) devices listed on the site. It is currently unclear how much data was exfiltrated by ALPHV during this attack, and EPM has yet to confirm further details about the attack overall. CTIX analysis will continue to monitor for attacks against critical infrastructure organizations and the activity of all groups that target the industry.