{"id":33408,"date":"2020-02-19T19:35:44","date_gmt":"2020-02-19T19:35:44","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/"},"modified":"2020-02-19T19:35:44","modified_gmt":"2020-02-19T19:35:44","slug":"when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/","title":{"rendered":"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops"},"content":{"rendered":"<p>America&#8217;s Homeland Security this week disclosed it recently responded to a ransomware infection at an unnamed natural gas plant.<\/p>\n<p>The cyber-nasty, described as a common or garden strain of file-scrambling Windows ransomware, did not result in any physical damage to equipment nor any of the programmable logic controller units that directly control gas flow at the compression facility, we&#8217;re told. It did, however, spread from an office computer through the plant&#8217;s IT network to the operational network of PCs that monitor the plant, overwriting documents and other data as it went.<\/p>\n<p>&#8220;A cyber threat actor used a spear-phishing link to obtain initial access to the organization\u2019s information technology network before pivoting to its operational technology network,&#8221; Homeland Security&#8217;s Cybersecurity and Infrastructure Security Agency (CISA) said in a <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/www.us-cert.gov\/ncas\/alerts\/aa20-049a\">Tuesday bulletin<\/a> describing the kerfuffle.<\/p>\n<p>&#8220;The threat actor then deployed commodity ransomware to encrypt data for impact on both networks.&#8221;<\/p>\n<p>CISA did not say where the infection occurred nor what malware code was used. However, infosec outfit Dragos <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/dragos.com\/blog\/industry-news\/assessment-of-ransomware-event-at-u-s-pipeline-operator\/\">speculated<\/a> today the agency is referring to the Ryuk ransomware family, which was used in a 2019 attack on the US Coast Guard.<\/p>\n<div class=\"promo_article\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/regmedia.co.uk\/2017\/01\/26\/saudi.jpg?x=174&amp;y=115&amp;crop=1\" width=\"174\" height=\"115\" alt=\"Saudi\"><\/p>\n<h2 title=\"Shamoon 2 software nasty is back and more evil than before\">Disk-nuking malware takes out Saudi Arabian gear. Yeah, wipe that smirk off your face, Iran<\/h2>\n<p><a href=\"https:\/\/www.theregister.co.uk\/2017\/01\/26\/shamoon_2_hits_saudi_arabian_targets\/\"><span>READ MORE<\/span><\/a><\/div>\n<p>In addition to failing to stop the spear-phishing that led to the infection, CISA says the plant&#8217;s operator fell short on separating the IT network from the operational systems of the plant. This made it easier for the malware to move between two networks that should have been isolated from one another, or at least better-secured.<\/p>\n<p>Fortunately, because the attack involved a piece of Windows-only ransomware, the malicious code was unable to affect the gas plant control systems that directly controlled operations. It appears the spear-phisher was more interested in holding files to ransom than specifically disrupting plant systems. Still, as a result of the infection, the plant had to be shut down as the monitoring systems were cleaned up.<\/p>\n<p>&#8220;Although the victim\u2019s emergency response plan did not specifically consider cyberattacks, the decision was made to implement a deliberate and controlled shutdown to operations,&#8221; CISA noted. &#8220;This lasted approximately two days, resulting in a loss of productivity and revenue, after which normal operations resumed.&#8221;<\/p>\n<p>Malware infections in oil and gas plants have long been seen as a danger, but those cases usually concern purpose built-malware and spyware designed with infrastructure targets in mind. This attack was caused by what Homeland Security calls a &#8220;commodity&#8221; ransomware infection that was apparently just looking for Windows PCs to lock up.<\/p>\n<p>We asked Homeland Security where the gas plant was located; it declined to comment. You could assume the US government organization is referring to a facility on its home soil. \u00ae<\/p>\n<p class=\"wptl btm\"><span>Sponsored:<\/span> <a href=\"https:\/\/go.theregister.co.uk\/tl\/1889\/-8120\/detecting-cyber-attacks-as-a-small-to-medium-business?td=wptl1889\">Detecting cyber attacks as a small to medium business<\/a><\/p>\n<p>READ MORE <a href=\"https:\/\/go.theregister.co.uk\/feed\/www.theregister.co.uk\/2020\/02\/19\/dhs_confirms_ransomware_attack\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Mystery plant hit by &#8216;commodity&#8217; infection thought to be Ryuk America&#8217;s Homeland Security this week disclosed it recently responded to a ransomware infection at an unnamed natural gas plant.\u2026  READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":33409,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-33408","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-02-19T19:35:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/02\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"174\" \/>\n\t<meta property=\"og:image:height\" content=\"115\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops\",\"datePublished\":\"2020-02-19T19:35:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/\"},\"wordCount\":493,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/02\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/\",\"name\":\"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/02\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg\",\"datePublished\":\"2020-02-19T19:35:44+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/02\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/02\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg\",\"width\":174,\"height\":115},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/","og_locale":"en_US","og_type":"article","og_title":"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-02-19T19:35:44+00:00","og_image":[{"width":174,"height":115,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/02\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops","datePublished":"2020-02-19T19:35:44+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/"},"wordCount":493,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/02\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/","url":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/","name":"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/02\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg","datePublished":"2020-02-19T19:35:44+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/02\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/02\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops.jpg","width":174,"height":115},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/when-the-air-gap-is-the-space-between-the-ears-a-natural-gas-plant-let-ransomware-spread-from-office-it-to-ops\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"When the air gap is the space between the ears: A natural gas plant let ransomware spread from office IT to ops"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/33408","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=33408"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/33408\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/33409"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=33408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=33408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=33408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}