Microsoft Warns of Lapsus$ “Targeting Organizations for Data Exfiltration and Destruction”
The group behind the recent attacks on Okta, NVIDIA, and Microsoft may be moving on to less-prominent organizations, using their data destruction extortion model on new victims.
It’s not every day Microsoft puts out warnings about a specific threat group. But in the case of Lapsus$ (referenced by Microsoft as DEV-0537), it’s warranted. Lapsus$ has gone after some pretty big-name companies (including Microsoft) and appears to be going after “smaller fish” as well, Microsoft warns in a recent threat intelligence update.
What makes Lapsus$ so dangerous is two-fold. First, their attacks are focused on extortion via the threat of data destruction (so, think ransomware, but deletion instead of encryption). Second, they are very good at soliciting for and obtaining credentialed access to organizations. This is a bit of a new tactic, as most cybercriminal gangs stick to phishing or brute force attacks against an RDP connection. Lapsus$ even goes as far as to pay off employees at cellular companies to perform SIM swaps that assigns an employee’s mobile number to a threat actor-controlled device. This allows Lapsus$ to get past most multi-factor authentication that uses an employee’s mobile phone as the second factor.
These guys are so good, they’re even finding ways to join a victim organization’s crisis communication calls to understand their incident response plan, giving Lapsus$ the upper hand to ensure their extortion tactics still pay off.
I’d normally want to mention the importance of Security Awareness Training in cases when phishing and social engineering attacks are used. But in the case of Lapsus$, the expertise demonstrated to date, along with their ability to exploit vulnerabilities to gain access to systems and data makes them particularly dangerous and noteworthy.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW