US Gas Compression Facility Ransomware (2020)

Victim:

US Gas

Attacker/Malware:

Russian Wizard Spider’s Ryuk Malware

Industry:

Oil and Gas/Energy

Estimated Cost:

Two-day shutdown of the pipeline, estimated $8-12M

Primary Attack Vector:

Phishing, IT-OT Lateral Movement

Prevention Failure:

Lack of IT-OT Segmentation

BlastWave Solution:

Network Cloaking, Passwordless Secure Access, and Segmentation

Kill Chain Analysis:

Misconfiguration and IT-OT Crossover

In February 2020, an unidentified ransomware variant successfully impacteda US natural gas compression facility.

The attack vector involved enticing the user to click a phishing link, andthen the ransomware traversed Internet-facing IT networks. Subsequently,it moved into the OT system responsible for monitoring pipeline operations.This forced the facility to shut down its control systems as a precautionaryor mandated measure.

The primary failure was network misconfiguration and a failure to enforce robustisolation between the exposed IT network and the sensitive OT monitoringsystems, allowing the ransomware to move across the perceived boundary anddisrupt availability.

BlastWave Prevention Analysis:

Enforcing Policy Over Configuration

The US Gas Compression Facility shutdown was a direct consequence of anetwork misconfiguration that enabled the ransomware to propagate laterally.BlastWave’s IDM solution enforces security through identity and policy, not network location.

By deploying a BlastWave Gateway to protect the pipeline monitoring OT system,the Gateway would enforce that only authenticated, authorized OT workstationscan initiate communication.

The ransomware, running on a compromised IT host, would lack the necessary cryptographic identity and policy authorization to even discover the Gateway or the OT system it protects, ensuring that misconfiguration in the IP scheme or firewall rules cannot bypass the Zero Trust enforcement layer.

Download Hackopedia Volume 1 Now – It's Free

Our Privacy Policy applies.

Take the Next Step

Reading about past failures is only useful if it changes future outcomes. If attackers can see your OT network, they can target it. If they can target it, compliance, safety, and uptime are already at risk.

BlastWave eliminates reconnaissance, initial access, and lateral movement — without agents, without downtime, and without changing IPs, protocols, or PLCs.

Secure Your OT Network