West Oil Group

West Oil Group, also known as WOG, is an Ukrainian oil company that operates fuel stations. Its core business involves the retail distribution of petroleum products such as gasoline and diesel. Many of its stations also offer convenience store items and basic automotive services. The company functions within the energy sector, supplying motor fuel to individual consumers and commercial fleets. Its headquarters are located in Ukraine, anchoring its operations to the national market. West Oil Group’s activities are focused on providing fuel and related services to customers.

In June 2017, West Oil Group was affected by the NotPetya cyber attack that originated from a compromised update of the M.E.Doc accounting software. The attack deployed ransomware variants identified as XData and PsCrypt, which encrypted systems on the company’s network and demanded payment in Bitcoin. Forensic analysis indicated that the perpetrators were a financially motivated group with limited technical sophistication in ransomware development. Despite attempting to masquerade as Ukrainian speakers, linguistic inconsistencies in the attack’s code and notes revealed the true origin of the threat actors. The incident highlighted West Oil Group’s reliance on digital accounting and operational technology, underscoring its role as part of the nation’s critical energy infrastructure. Consequently, the attack served as a case study of how cyber threats can impact essential service providers even when they are not the primary target.