Ukrainian cyber intelligence strikes Gazprom infrastructure — NV sources

The sources indicated that the cyberattack caused significant damage to Gazprom’s network infrastructure, including the destruction of large volumes of databases and the installation of special software.

The operation cut off access to Gazprom’s information system for 20,000 system administrators. In addition, the Ukrainian team installed software on the servers that will continue erasing data over time.

The following was destroyed:

• Backups of Gazprom's information system

• Databases of about 390 Gazprom subsidiaries and branches, including Gazprom Teplo Energo, Gazprom Obl Energo, and Gazprom Energosbyt

• Data clusters of 1C servers (10 extremely powerful servers), along with files like contracts, orders, and memos

• Data from auxiliary systems (including data protection, server control, admin systems, and more)

• Databases of analytics systems for pipelines, valves, sensors, pumps, and other elements

• Servers containing SCADA analytics responsible for managing technical infrastructure

• Operating systems on accessible servers, with BIOS corrupted, leaving the servers inoperable and requiring physical intervention to restore.

“The degradation of Russian information systems to the technological Middle Ages continues," HUR source said.

"We take this opportunity to congratulate Russian ‘IT specialists’ on yet another ‘achievement’ — and recommend they start replacing their mice and keyboards with hammers and crowbars as their primary tools.”

On July 15, it was reported that HUR cyber specialists, together with the Ukrainian Cyber Alliance and the BO Team, attacked the server and network infrastructure of Haskar Integration, one of Russia’s largest drone suppliers. The team gained access to over 47 terabytes of technical information about drone production in Russia and destroyed all server data, including 10 TB of backups.

On June 12, NV sources reported that cyber activists paralyzed Orion Telecom, one of the largest internet providers in Siberia. The company’s networks were actively used by Russian security forces to support the war against Ukraine.