Passavant Energy Ransomware Claim by settra (Sep 2026)

Claim Summary

The ransomware group known as settra has allegedly listed Passavant Energy & Environment GmbH (domain passavant-ee.com, Estonia) on its dark web leak site. The listing, dated September 25, 2026, purports to involve a healthcare-sector entity, though the actor’s own description frames the victim as a German engineering firm that builds wastewater treatment plants.

According to the threat actor, the claimed data includes internal debit notes and accounting records. The group alleges that Passavant is controlled by Dubai-based conglomerate Drake & Scull International PJSC and that it finances operations in Iraq. The actor further claims that employees of an Iraqi division traveled to Muscat, Oman, and stayed at hotels billed to Passavant’s Frankfurt office, with charges allegedly approved by the accounting department at Hahnstraße 31-35. The listing names an individual employee.

None of these allegations have been independently verified. The data volume is undisclosed.

Threat Actor Profile

settra is a relatively low-profile ransomware operation. Public research on the group is limited, and its total known victim count is unknown. No established toolset, malware family, or documented tactics, techniques, and procedures (TTPs) are publicly attributed to settra at this time. This absence of a track record is itself a credibility concern: groups with little documented history may exaggerate claims, recycle data, or operate as rebranded or opportunistic actors.

Because no YARA rules or detection signatures are publicly available for settra, defenders should rely on generic ransomware detection guidance - monitoring for unusual data staging, mass file encryption behavior, and anomalous outbound transfers - rather than actor-specific indicators.

Alleged Data Exposure

The actor claims to hold internal financial records, including debit notes attributed to a Drake & Scull Oil & Gas Iraq Branch, and alleges misuse of German and Swiss public funding (KfW, SECO). These are unverified assertions. Ransomware groups frequently embellish victim narratives to increase pressure and media attention. No data samples, credentials, or download references are included here by policy.

Potential Impact

If the claims were substantiated, the alleged exposure of financial and accounting records could raise governance, compliance, and reputational concerns, particularly given the purported public-funding angle. However, the healthcare-sector classification in the listing conflicts with the actor’s own description of an engineering firm, which suggests possible mislabeling or inflated categorization. Organizations in the Passavant supply chain should treat the claims with caution pending verification.

What to Watch For

• Official statements from Passavant Energy & Environment or parent entities.
• Any confirmation or denial from KfW, SECO, or Drake & Scull International.
• Regulatory disclosures in Germany, Switzerland, or Estonia.
• Follow-on extortion activity or data publication claims from settra.
• Whether settra demonstrates verifiable proof-of-possession, which it has not publicly done.

Disclaimer

This report is based solely on an unverified claim posted to a ransomware leak site. Yazoul Security has not independently confirmed the breach, the data, the corporate relationships, or the financial allegations described. Ransomware groups routinely exaggerate or fabricate claims to pressure victims. Nothing here should be treated as fact. For related monitoring, see our intel section.