The cybersecurity world took notice. Within months, a small collective had formed around the original coder—a reclusive mathematician and former geophysicist known only as They shared two obsessions: extreme optimization for low-powered hardware (a necessity in Siberia’s infrastructure-poor towns) and a philosophical belief in “permanent data autonomy.” Chapter 2: The Core Philosophy – "Code as Permafrost" Unlike Western open-source movements that worshipped transparency, SiberiaProg’s philosophy was unique: Code should be like permafrost—stable, ancient, buried deep, and hostile to superficial change.
It was a data-wiping tool. But unlike the noisy, destructive viruses of the era, this one was surgical. It didn't delete files; it encrypted them with a timestamp-based key that would only unlock after a specific date—sometimes years in the future. The user called it “cryogenic storage for secrets.” siberiaprog
No one paid. The company restored from backups six weeks later. But on January 15, 2025—exactly ten years after the infection—the decryption keys spontaneously appeared on a public pastebin, and every locked file unlocked simultaneously. The message attached read: “We keep our word. Even the cold ones.” Who is SiberiaProg today? Speculation runs rampant. Some say Nikolai V. died in a climbing accident in the Altai Mountains in 2018. Others claim the collective was absorbed by a state actor—either the GRU or the FSB, given their operational brilliance. A few romanticists insist they remain independent, living off bounties and selling bespoke “cryo-kits” to journalists and dissidents. The cybersecurity world took notice
It was absurd. It was brilliant. It was pure SiberiaProg. But unlike the noisy, destructive viruses of the
What shocked investigators wasn't the ransom—it was the method. The malware had spread not through phishing or zero-days, but through a flaw in the company’s heating system’s control unit , which had been connected to the corporate LAN. The attackers had identified a thermal overrun vulnerability, causing the HVAC system to cycle erratically, which in turn triggered a firmware glitch in the network switches.
But to this day, every few winters, a new tool will appear on an obscure Tor onion site. It will be signed with a cryptographic key dating back to 2009. It will have no documentation, no support forum, and no explanation. It will simply work —cold, efficient, and utterly indifferent to the panic it causes in boardrooms from Houston to Hong Kong.
Subscribe to receive new blog posts from Axonator in your RSS reader.
Subscribe to RSSAxonator is mobile-first digital platform for frontline teams.
View roles