ragnarlocker attacks Hellenic Gas Transmission System Operator S.A.
Incident Date:
August 19, 2022
Overview
Title
ragnarlocker attacks Hellenic Gas Transmission System Operator S.A.
Victim
Hellenic Gas Transmission System Operator S.A.
Attacker
Ragnarlocker
Location
First Reported
August 19, 2022
Ragnar Locker Targets Hellenic Gas Transmission System Operator S.A.
Company Overview
Established in 2007 as a subsidiary of Depa (Public Gas Corporation of Greece), DESFA operates the country's natural gas transmission system and its gas distribution networks. The company is also responsible for managing the Revithoussa LNG Terminal, a critical infrastructure for regasifying liquefied natural gas imported by tankers.
Impact and Response
The cyberattack led to the deactivation of most of DESFA's IT services. However, the company has been progressively restoring these services to normal operations. Importantly, the management of the National Natural Gas System (NNGS) remained unaffected, ensuring the continuous and safe supply of natural gas across Greece. In response to the attack, DESFA has engaged IT security experts to investigate the breach and restore the integrity of affected systems. Additionally, the company has notified relevant authorities and organizations to collaboratively address and mitigate the incident's impact.
Vulnerabilities and Threats
Ragnar Locker, the group claiming responsibility for the attack, is notorious for its 'double extortion' strategy. This approach involves first exfiltrating sensitive data from the victim for potential extortion, followed by encrypting the victim's data to cripple their operations. The group has also shown a propensity for exploiting Remote Desktop Protocol (RDP) connections to gain entry and deploying custom virtual machines to conduct their operations undetected.
Industry Concerns
The attack on DESFA underscores a growing trend of ransomware groups targeting critical infrastructure sectors. Such incidents spotlight the vulnerabilities of industrial operations and operational technology (OT) networks to cyber threats. The targeting of essential services by ransomware groups has escalated concerns among government and industry experts regarding the security of critical infrastructure organizations' operational networks globally.
Sources
- "Greek gas operator refuses to negotiate with ransomware group after attack" - The Record
- "Ransomware Gang Leaks Data Allegedly Stolen From Greek Gas Supplier" - SecurityWeek
- "Greek Natural Gas Supplier DESFA Hacked by Ragnar Locker Ransomware Crew" - Bitdefender
- "Ragnar Locker Likely Behind Attack on Greek Gas Operator" - BankInfoSecurity
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.