Microsoft Shares Details On Lapsus$ Hacking Operations

Share post:

Microsoft has uncovered the activities of Lapsus$, a relatively new hacking group conducting cyberattacks against organizations.

According to Microsoft, Lapsus$ dubbed DEV-0537 uses an extortion and destruction model of attack. This model does not rely on ransomware payloads.

The group employs different social engineering schemes to lure potential victims. This includes phone-based social engineering via SIM-swapping and compromising an individual’s personal or private accounts.

Other tactics include deceiving the company’s support representatives into divulging secrets and carrying out an alliance with employees to gain access to account credentials and MFA details.

The group also purchases credentials and tokens from forums on the Dark Web, scans public code repositories for exposed credentials, and uses a password stealer known as Redline to capture passwords and tokens.

Organizations are advised to protect themselves by requiring MFA for all users, avoiding telephone-based and SMS-based MFA, using Azure AD password protection, and using other password authentication tools.

Others include reviewing their VPN authentication, monitoring and reviewing their cloud security, educating all employees about social engineering attacks, and setting up security processes in response to possible Lapsus$ intrusions.

For more information, read the original story in TechRepublic.



Related articles

Socket develops tool to protect developers from npm vulnerabilities

Socket, a security firm, has created a new method for protecting developers from the flaws in npm, GitHub's...

Google spots vulnerabilities in Exynos chips that could affect Androids

Google is urging Android phone owners, such as those who own Samsung, Pixel, or Vivo phones, to take...

Orlando Family Physicians agrees to settle clients affected by data breach

Orlando Family Physicians (OFP) has reached a class action settlement to resolve claims stemming from a 2021 healthcare...

FBI arrests alleged head of BreachForums criminal market

Man arrested in New York state is believed to have run one of the biggest criminal forums in

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways