ragnarlocker attacks Hellenic Gas Transmission System Operator S.A.

Incident Date:

August 19, 2022

World map



ragnarlocker attacks Hellenic Gas Transmission System Operator S.A.


Hellenic Gas Transmission System Operator S.A.




Chalandri, Greece

Chalandri, Greece

First Reported

August 19, 2022

Ragnar Locker Targets Hellenic Gas Transmission System Operator S.A.

Company Overview

Established in 2007 as a subsidiary of Depa (Public Gas Corporation of Greece), DESFA operates the country's natural gas transmission system and its gas distribution networks. The company is also responsible for managing the Revithoussa LNG Terminal, a critical infrastructure for regasifying liquefied natural gas imported by tankers.

Impact and Response

The cyberattack led to the deactivation of most of DESFA's IT services. However, the company has been progressively restoring these services to normal operations. Importantly, the management of the National Natural Gas System (NNGS) remained unaffected, ensuring the continuous and safe supply of natural gas across Greece. In response to the attack, DESFA has engaged IT security experts to investigate the breach and restore the integrity of affected systems. Additionally, the company has notified relevant authorities and organizations to collaboratively address and mitigate the incident's impact.

Vulnerabilities and Threats

Ragnar Locker, the group claiming responsibility for the attack, is notorious for its 'double extortion' strategy. This approach involves first exfiltrating sensitive data from the victim for potential extortion, followed by encrypting the victim's data to cripple their operations. The group has also shown a propensity for exploiting Remote Desktop Protocol (RDP) connections to gain entry and deploying custom virtual machines to conduct their operations undetected.

Industry Concerns

The attack on DESFA underscores a growing trend of ransomware groups targeting critical infrastructure sectors. Such incidents spotlight the vulnerabilities of industrial operations and operational technology (OT) networks to cyber threats. The targeting of essential services by ransomware groups has escalated concerns among government and industry experts regarding the security of critical infrastructure organizations' operational networks globally.


Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.