Forest Global Training Partners

Cyber Risks · Krebs on Security

Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code

Summary: KrebsOnSecurity reviewed a week of private LAPSUS$ chat logs showing the group breached T-Mobile multiple times in March 2022 and stole more than 30,000 source code repositories, with T-Mobile stating no customer or government information was taken. The logs show LAPSUS$ bought initial access and VPN credentials from sites like Russian Market, socially engineered employees into enrolling devices, and gained access to T-Mobile's Atlas account-management tool, where the group's 17-year-old leader looked up FBI and Department of Defense accounts before shutting down the VPN connection to focus on source code theft.

Why it matters: LAPSUS$ kept replacing cut-off T-Mobile VPN credentials by finding or buying new ones, and the group reached Atlas, the internal tool for managing customer accounts, where FBI and DoD accounts were only protected by additional verification steps. The leaked chats also show the group spent days trying to bypass multi-factor authentication and device enrollment controls at Iqor and gave up only after employees repeatedly refused to change MFA settings.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related