A Closer Look at the LAPSUS$ Data Extortion Group
Summary: LAPSUS$, a group that first surfaced in December 2021 with an extortion demand on Brazil's Ministry of Health, breached Microsoft and Okta this week and has posted screenshots of internal tools from NVIDIA, Samsung, and Vodafone. Microsoft said it interrupted the group's source code download mid-operation after LAPSUS$ discussed the access on its Telegram channel, which has more than 45,000 subscribers, and described the group's main access method as social engineering - bribing or tricking employees and partners, including help desk staff, to provide credentials and approve MFA prompts.
Why it matters: LAPSUS$ offered up to $20,000 a week to employees at AT&T, T-Mobile, and Verizon for inside jobs, and Microsoft found the group resetting privileged credentials by answering recovery prompts like a mother's maiden name with help desk staff - so the control that fails here is a person, not a firewall.
Read the original at Krebs on Security ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·