- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(high confidence)
- Sponsor
- Russian Federation
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2016–2017
- Status
- Dormant
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0321 · operation-bugdrop
RussiaWhat it is
This threat actor targets critical infrastructure entities in the oil and gas sector, primarily in Ukraine. The threat actors deploy the BugDrop malware to remotely access the microphones in their targets' computers to eavesdrop on conversations.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Austria, Russia, Saudi Arabia, Ukraine
- Sectors
- Engineering, Media, Oil and gas, Private sector, Research
Tools
The tools and malware families the sources tie to it.
- Dropbox
- Remote Utilities
- RemoteCMD
- RemotePC
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de