Gazprom Under Fire: July 2025 Cyberattack

On July 17, 2025, Ukrainian hackers carried out a major cyberattack on Russia’s energy giant Gazprom knocking critical systems offline, wiping out key data, and locking out thousands of employees. While the strike made international headlines, it wasn’t just a one-off event. It was the latest move in a long-running digital battle between Ukraine and Russia that’s been unfolding since 2014. From power outages and ransomware to data leaks and financial sabotage, the two countries have been fighting a high-stakes war in cyberspace. In this blog, we’ll break down what really happened at Gazprom and take a closer look at how this behind-the-scenes cyberwar has evolved over the last decade.

Confirmed Website Outage

The cyberattack focused on Gazprom’s digital infrastructure, which includes servers, internal networks, databases, and special control systems used to manage gas pipelines.

image source : https://kyivindependent.com

According to Ukrainian sources:

The attack hit about 390 different branches of Gazprom.
Over 20,000 system administrators were locked out of their accounts, meaning they could not access or control company systems.
Important software and servers, especially ones used to manage contracts, payments, and scheduling, were completely wiped.
Backup copies of important data were also deleted, making recovery very difficult.
Control systems for gas flow, pressure, and pipelines were damaged or destroyed.
Some computer systems had their firmware and operating systems erased, which means they could not even turn on or be fixed remotely.

At the time of writing, there has been no official statement from Gazprom or Russian authorities confirming the extent of the impact. As such, the full effect on operations or services remains unclear. The event, however, has attracted attention due to the scale of the reported cyber activity and its timing within the broader digital conflict between Ukraine and Russia.

A Digital War With Deep Roots

This latest attack isn’t an isolated event. Ukraine and Russia have been engaged in a covert cyberwar since at least 2014. Ukraine has long been a testing ground for Russian cyber tools, while Ukraine has retaliated with its own digital offensives.

Over the years, these digital clashes have hit government agencies, energy systems, financial networks, and even civilian infrastructure. To better understand the scale and evolution of this conflict, here are some of the most significant cyber events that have shaped the Ukraine–Russia cyberwar.

The Cyberwar Begins: 2015–2017

2015 – BlackEnergy Power Grid Attack

In December 2015, Russian hackers used the BlackEnergy malware to disable power stations in western Ukraine. Nearly 230,000 people lost electricity in what was the world’s first known successful cyberattack on a power grid.

2016 – Second Attack on Ukraine’s Power Grid

A year later, a more sophisticated attack again hit Ukraine’s electrical infrastructure, briefly blacking out part of Kyiv. These early intrusions laid the groundwork for Russia’s later efforts to compromise critical infrastructure.

2022 Pre‑Invasion Strikes

Attacks on Ukrainian Government Websites

In mid-January 2022, Ukrainian authorities detected a wave of cyberattacks that disabled dozens of government websites. Between January 13–14, the WhisperGate malware infected government servers, corrupting files and displaying fake ransomware messages. About 70 official websites were defaced before most were restored within hours. U.S. and Ukrainian cybersecurity experts traced the attacks to Russian state-sponsored actors, with Microsoft and Palo Alto confirming the use of WhisperGate by a group known as DEV‑0586 .

Later, around February 15–16, large DDoS attacks again targeted government and banking websites in Ukraine. These disrupted public services and were officially attributed to Russian state actors by U.S. and U.K. intelligence .

Data‑Wiper Attacks

Just before the full invasion, from February 23–24, Russia deployed the HermeticWiper malware. This destructive program wiped data from Windows machines by targeting the master boot record, rendering systems unbootable. Security firms observed the malware’s operation and confirmed its widespread destructive effects

Satellite Internet Disruption

On February 24, 2022, simultaneous to the military invasion, a cyberattack hit Viasat’s KA‑SAT satellite internet network. Thousands of satellite modems used by both civilians and military, were overwritten with a wiper malware called AcidRain, designed to irreversibly wipe modem firmware. AcidRain was later identified as a more general-purpose wiper capable of targeting multiple Linux-based embedded devices, hinting at broader intentions beyond just one satellite provider.

The outage affected tens of thousands of users across Ukraine and Europe, including remote wind farm controls. The EU, U.S., and U.K. formally blamed Russian military intelligence for this offensive against Ukrainian military communications

Energy Sector & Power Grid

In April 2022, the GRU-linked Sandworm group attempted to cripple Ukraine’s electricity grid using malware dubbed Industroyer2. Thankfully, defenders intercepted the effort before it caused major damage. This action continued Russia’s pattern of attacking critical infrastructure alongside military movements

Cyberespionage and Data Leaks

2016 – Surkov Leaks

In 2016, Ukrainian hacktivists leaked emails from Vladislav Surkov, a key advisor to President Putin. These documents exposed details of Russia’s role in managing separatist factions in eastern Ukraine, drawing attention to what many saw as another cyber front in the ongoing conflict.

2022–2023 – Breaches of Russian Banks

During and after the 2022 invasion, Ukrainian-linked cyber groups targeted Russia’s financial institutions , most notably Gazprombank. Hackers infiltrated networks, stealing sensitive financial data and internal documents, then leaked them publicly. This disrupted banking operations and exposed confidential information to the public.

Attacks on Financial Systems

2022 – Sberbank & Moscow Exchange DDoS

Ukraine’s volunteer IT Army launched major DDoS attacks in early 2022 aimed at disabling online services of Russia’s top bank, Sberbank, and the Moscow Stock Exchange. These attacks caused temporary outages on key financial platforms, adding financial strain to the broader conflict.

2017 – NotPetya Malware

In mid-2017, a destructive malware called NotPetya developed by Russia was disguised as ransomware and infected Ukrainian tax software.It quickly spread globally, disrupting operations at companies like Maersk, Merck, and Rosneft. Ultimately, the attack caused more than $10 billion in damages worldwide.

Cyber Spillover: Attacks Beyond Ukraine

The Ukraine–Russia cyberwar hasn’t remained confined to national borders. In 2023, pro-Russian hacktivist groups launched a series of coordinated DDoS attacks targeting infrastructure in NATO member countries. Financial services, transportation systems, and government websites across parts of Europe particularly in Germany, Poland, and Sweden experienced temporary disruptions.

One of the most active groups, NoName057(16), claimed responsibility for many of these attacks, aligning themselves with Russia’s broader geopolitical objectives. Although these actors are not officially part of the Russian state, their operations serve as a form of asymmetric pressure in the ongoing conflict.

This marked a turning point in the digital war: a shift from targeted regional attacks to broader international disruption reminding the world that cyber conflict knows no borders.

The Cyberwar Isn’t Just Ukraine’s Problem Anymore

It’s easy to see this as a distant conflict one happening far from home, deep in military systems or government networks. But that couldn’t be further from the truth. What’s happening between Ukraine and Russia in cyberspace has real implications for all of us.

Hospitals, power stations, financial systems, even satellites things ordinary people rely on every day have been targeted. These aren’t just warzone attacks. They’ve spilled into Europe and beyond.

Take companies like Maersk and Merck, for example. They had no stake in the Ukraine conflict, yet were hit with devastating malware that started there. Losses reached into the billions. All from one piece of code.

This war has taught us something : your country doesn’t have to be at war for your internet to be.

Final Thoughts

The cyberattack on Gazprom may feel like a breaking point, but it’s really just the latest move in a conflict that’s been playing out for years quietly, digitally, and dangerously. From blackouts to satellite outages, from leaked emails to global malware outbreaks, the Ukraine–Russia cyberwar has pushed the boundaries of what modern conflict looks like.

As digital weapons become more sophisticated and more widely used, one thing is clear: this isn't just Ukraine's war or Russia's strategy it's a glimpse into the future of global security.

Understanding these attacks isn’t just about tracking history. It’s about recognizing the digital front lines that now shape our politics, our businesses, and our lives.