Microsoft Shares Details On Lapsus$ Hacking Operations

Share post:

Microsoft has uncovered the activities of Lapsus$, a relatively new hacking group conducting cyberattacks against organizations.

According to Microsoft, Lapsus$ dubbed DEV-0537 uses an extortion and destruction model of attack. This model does not rely on ransomware payloads.

The group employs different social engineering schemes to lure potential victims. This includes phone-based social engineering via SIM-swapping and compromising an individual’s personal or private accounts.

Other tactics include deceiving the company’s support representatives into divulging secrets and carrying out an alliance with employees to gain access to account credentials and MFA details.

The group also purchases credentials and tokens from forums on the Dark Web, scans public code repositories for exposed credentials, and uses a password stealer known as Redline to capture passwords and tokens.

Organizations are advised to protect themselves by requiring MFA for all users, avoiding telephone-based and SMS-based MFA, using Azure AD password protection, and using other password authentication tools.

Others include reviewing their VPN authentication, monitoring and reviewing their cloud security, educating all employees about social engineering attacks, and setting up security processes in response to possible Lapsus$ intrusions.

For more information, read the original story in TechRepublic.


Related articles

Cyber Security Today, June 21, 2024 – US to ban Kaspersky for businesses, consumers

U.S. to ban the sale of Kaspersky products to consumers and businesses. Welcome to Cyber Security Today. It's Friday...

Biden administration to ban US sales of Kaspersky software over ties to Russia

The Biden administration is set to announce a ban on the sale of Kaspersky Lab's antivirus software in...

Security bug may allow anyone to spoof Microsoft employee emails

A security researcher claims to have discovered a bug that enables anyone to impersonate Microsoft corporate email accounts,...

Cyber Security Today, June 19, 2024 – How an attacker hid on an IT network for three years

How an attacker hid on an IT network for three years Welcome to Cyber Security Today. It's Wednesday June...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways