Type
Campaign
Actors
LAPSUS$
Pub. date
March 22, 2022
Initial access
End-user compromise
Impact
Data exfiltrationData destructionRansomOp
Observed techniques
Vulnerability exploitationCloud API enumerationAbuse trust and privileges across accountsCredential theft
Targeted technologies
GitLabJira ServerConfluence ServerGitHubSharePoint
References
https://www.microsoft.com/en-us/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/https://www.wiz.io/blog/hardening-your-cloud-environment-against-lapsus-like-threat-actorhttps://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf
Status
Finalized
Last edited
Jun 2, 2024 8:02 AM
According to Microsoft Threat Research, as part of LAPSUS$’s large-scale social engineering and extortion campaigns, they also gained access to several of their targets’ cloud environments.
LAPSUS$ initially targeted organizations in the UK and South America, and then expanded their activity to other countries.
Their attack flow can be described as split into the following three stages:
- Gaining initial access to on-premise environments through compromised users - the threat actors were able to gain access to the targeted systems after performing social engineering techniques that led them to impersonating user accounts and bypassing insecure authentication mechanisms in order to gain access to their targets’ cloud environments.
- Abusing access to exploit unpatched applications and gather exposed secrets - after gaining initial access, the threat actors were able to abuse their obtained privileges in order to perform additional malicious actions such as spinning up new resources to stage their activity, exploiting known vulnerabilities for newly accessible resources, escalating their privileges and moving laterally. If they were able to grant themselves administrator status they would also lock out existing admin users.
- Gaining access to internal cloud infrastructure resources - the threat actors were also able to move further laterally into their targeted organizations’ cloud environments until eventually gaining access to sensitive data they deemed could be used for extortion. Once they had decided they had reached their goals, they deleted the compromised systems and resources.