The group behind the recent attacks on Okta, NVIDIA, and Microsoft may be moving on to less-prominent organizations, using their data destruction extortion model on new victims.
It’s not every day Microsoft puts out warnings about a specific threat group. But in the case of Lapsus$ (referenced by Microsoft as DEV-0537), it’s warranted. Lapsus$ has gone after some pretty big-name companies (including Microsoft) and appears to be going after “smaller fish” as well, Microsoft warns in a recent threat intelligence update.
What makes Lapsus$ so dangerous is two-fold. First, their attacks are focused on extortion via the threat of data destruction (so, think ransomware, but deletion instead of encryption). Second, they are very good at soliciting for and obtaining credentialed access to organizations. This is a bit of a new tactic, as most cybercriminal gangs stick to phishing or brute force attacks against an RDP connection. Lapsus$ even goes as far as to pay off employees at cellular companies to perform SIM swaps that assigns an employee’s mobile number to a threat actor-controlled device. This allows Lapsus$ to get past most multi-factor authentication that uses an employee’s mobile phone as the second factor.
These guys are so good, they’re even finding ways to join a victim organization’s crisis communication calls to understand their incident response plan, giving Lapsus$ the upper hand to ensure their extortion tactics still pay off.
I’d normally want to mention the importance of Security Awareness Training in cases when phishing and social engineering attacks are used. But in the case of Lapsus$, the expertise demonstrated to date, along with their ability to exploit vulnerabilities to gain access to systems and data makes them particularly dangerous and noteworthy.
Here's how it works:
