Microolap Limits Breach Scope to Non-Production Systems After Black Spark Claims EtherSensor Access

Microolap's internal logs showed the intrusion reached only isolated development hosts hosted by a third-party Russian provider plus an archived website and legacy CRM. No production EtherSensor components, customer datasets, or network capture modules were touched, according to the company's post-incident review conducted with an unnamed major Russian security vendor. Black Spark published unverified screenshots purporting to show internal directories and deleted files belonging to state-linked clients.

Technical indicators released by the company point to initial access via unpatched external-facing systems rather than supply-chain compromise or credential theft from core infrastructure. This pattern matches prior low-sophistication operations attributed to Ukrainian-aligned hacktivist clusters that prioritize public claims over sustained persistence. Independent verification of the screenshots remains absent.

EtherSensor's documented use by Russian law enforcement and critical infrastructure operators for lawful interception creates a high-value target profile. The limited breach does not degrade current collection capability, yet it signals that even niche surveillance vendors face direct pressure from Ukrainian-aligned actors operating inside Russia.

Microolap has taken the old site offline and added monitoring. Next observable indicators will be whether Black Spark releases additional artifacts or whether Russian authorities issue procurement guidance tightening vendor security requirements for interception platforms.