Operation BugDrop is a Russian state-backed cyber espionage group targeting the oil and gas sector.
Operation BugDrop is a Russian nation-state cyber espionage group targeting critical infrastructure entities in the oil and gas sector, primarily in Ukraine. Their targets also include private sector organizations in Austria, Russia, and Saudi Arabia. The main TTP involves deploying the BugDrop malware to gain remote access to and eavesdrop via the microphones of compromised computers. Defenders should monitor for unusual microphone access attempts, analyze network traffic for C2 indicators associated with BugDrop, and strictly enforce microphone permission policies on critical oil and gas systems.
This threat actor targets critical infrastructure entities in the oil and gas sector, primarily in Ukraine. The threat actors deploy the BugDrop malware to remotely access the microphones in their targets' computers to eavesdrop on conversations.
Operation BugDrop primarily targets critical infrastructure entities in the oil and gas sector in Ukraine, as well as private sector organizations in Austria, Russia, and Saudi Arabia.
Their main TTP is deploying the BugDrop malware to gain remote access to and eavesdrop via the microphones of compromised computers.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.