Russian software developer Microolap has confirmed a cyberattack on some of its systems, though it disputes the extent of the breach claimed by a pro-Ukraine hacking group. The company, which specializes in network traffic interception and analysis software, stated on Thursday that it detected an attempted intrusion into several non-critical systems. However, Microolap denied that attackers accessed its core infrastructure, its EtherSensor network monitoring platform, or sensitive customer data.
The confirmation followed claims made by a group identifying itself as Black Spark. The hackers asserted they had maintained access to Microolap's network for over a month, gaining entry to internal systems including EtherSensor. Black Spark further claimed to have extracted and deleted data belonging to several Microolap clients, specifically naming Russian Railways, state document producer Goznak, VTB Bank and its leasing subsidiary, and Russian IT firm NEK.TECH. The group published screenshots purportedly showing compromised systems and data, though the authenticity of these images remains unverified.
Microolap CEO Andrey Smirnov urged caution regarding the attackers' claims, stating that the company's cybersecurity systems functioned as intended by detecting the incident and securing critical data. The company's investigation indicated that the attackers accessed a few rarely used development systems hosted by a different Russian provider, an outdated version of its website, and an old Bitrix24 customer management system containing a limited amount of data.
According to Microolap, these affected systems were isolated from its core infrastructure, and their compromise did not grant attackers access to EtherSensor or any data belonging to customers and partners. The company emphasized that none of its production systems or components critical to EtherSensor were impacted, and the platform continued to operate normally without any effect on its performance, data integrity, or availability.
In response to the incident, Microolap has taken its outdated website offline, implemented additional security measures, and initiated an investigation with the assistance of an unnamed major Russian cybersecurity company.
Black Spark describes itself as an "underground movement" within Russia. In a manifesto published on Telegram, the group stated that its members remain in Russia and have opted for what they termed "armed resistance."
