Ragnar Locker Targets Hellenic Gas Transmission System Operator S.A.

Company Overview

Established in 2007 as a subsidiary of Depa (Public Gas Corporation of Greece), DESFA operates the country's natural gas transmission system and its gas distribution networks. The company is also responsible for managing the Revithoussa LNG Terminal, a critical infrastructure for regasifying liquefied natural gas imported by tankers.

Impact and Response

The cyberattack led to the deactivation of most of DESFA's IT services. However, the company has been progressively restoring these services to normal operations. Importantly, the management of the National Natural Gas System (NNGS) remained unaffected, ensuring the continuous and safe supply of natural gas across Greece. In response to the attack, DESFA has engaged IT security experts to investigate the breach and restore the integrity of affected systems. Additionally, the company has notified relevant authorities and organizations to collaboratively address and mitigate the incident's impact.

Vulnerabilities and Threats

Ragnar Locker, the group claiming responsibility for the attack, is notorious for its 'double extortion' strategy. This approach involves first exfiltrating sensitive data from the victim for potential extortion, followed by encrypting the victim's data to cripple their operations. The group has also shown a propensity for exploiting Remote Desktop Protocol (RDP) connections to gain entry and deploying custom virtual machines to conduct their operations undetected.

Industry Concerns

The attack on DESFA underscores a growing trend of ransomware groups targeting critical infrastructure sectors. Such incidents spotlight the vulnerabilities of industrial operations and operational technology (OT) networks to cyber threats. The targeting of essential services by ransomware groups has escalated concerns among government and industry experts regarding the security of critical infrastructure organizations' operational networks globally.

Sources

• "Greek gas operator refuses to negotiate with ransomware group after attack" - The Record
• "Ransomware Gang Leaks Data Allegedly Stolen From Greek Gas Supplier" - SecurityWeek
• "Greek Natural Gas Supplier DESFA Hacked by Ragnar Locker Ransomware Crew" - Bitdefender
• "Ragnar Locker Likely Behind Attack on Greek Gas Operator" - BankInfoSecurity