Gazprom

Gazprom, named after the Russian gas giant, is a malicious software (malware) that has been causing significant disruption in the digital world. The malware uses leaked Conti source code and is often mistaken for LockBit crypto-locker due to its similar operational style. This confusion is further compounded by the fact that it's being employed by various unaffiliated criminal entities such as the Bloody Ransomware Gang. Gazprom malware first gained notoriety in 1999 when it was used in a cyber attack against Gazprom company itself, where a trojan horse was installed in the company’s pipeline system’s network, severely impacting the control over gas flow. The Gazprom malware has recently been leveraged in high-profile cyber attacks, particularly amidst the conflict between Ukraine and Russia. Ukraine's newly formed "IT army" has been instrumental in launching disruptive cyber-attacks and data thefts against the Russian government and other high-profile targets, including Gazprom. In response, Gazprom Media reported that its infrastructure had been attacked, indicating an escalation in cyber warfare tactics. The malware has also been used in ransomware attacks, with victims receiving a ransom note featuring ASCII art of Russia's president. Gazprom malware's activities are not limited to political or military contexts. It has also infiltrated the commercial sector, serving customers from Fortune 500 companies, including Xerox, Samsung, Volkswagen, KIA, Gazprom, Vogue, and PC Magazine, according to Bitrix24's LinkedIn page. This broad range of targets underscores the significant threat posed by Gazprom malware to both public and private sectors worldwide. The malware's use in politically motivated decisions, such as Gazprom's 2006 move to cut gas supplies to Ukraine, further highlights the potential for this malware to be exploited for geopolitical gains.