Threat Intelligence and Security Incidents
Microsoft admits to hack: Is the emerging data extortion group Lapsus$ truly unstoppable?
On March 22, Microsoft publicly admitted that one of their employees had been compromised by the Lapsus$ hacking group, allowing attackers to access and steal a portion of their source code.
Lapsus$ is a data extortion hacker group that burst onto the scene. They do not install ransomware on victims' devices. Instead, by breaching corporate systems, they steal source code, customer lists, databases, and other valuable data, threatening to release the data publicly to extort large ransoms from the victim companies.
On March 20, the Lapsus$ group announced they had breached Microsoft's Azure DevOps servers to steal 37GB of source code and published a screenshot of the source code repository. On the evening of the 21st, Lapsus$ released a torrent file of a 9GB 7zip archive, containing what they claimed to be the source code for over 250 of Microsoft's projects. Relevant sources said this uncompressed archive file is approximately 37GB. Lapsus$ stated that it contains 90% of the Bing source code and around 45% of the Bing Maps and Cortana code.
Leaked Source Code Projects
"The observed activity did not involve customer code or data. Our investigation found that a single account had been compromised, granting limited access. Our cybersecurity response teams quickly engaged to remediate the compromised account and prevent further activity." "When the attackers publicly disclosed their intrusion, our team was already investigating the compromised account based on threat intelligence. This public disclosure escalated our defense measures and processes, enabling our team to intervene and interrupt the attackers during their operations, thereby limiting broader impact." Microsoft also stated in its March 22 announcement that Microsoft does not rely on code secrecy as a security measure, and viewing source code does not lead to elevated risk. Even so, this does not mean that the source code contains no other valuable data. Source code repositories typically also contain access tokens, credentials, API keys, and even code-signing certificates. Although Microsoft did not share how the account was compromised, they provided an overall overview of the tactics, techniques, and procedures (TTPs) observed from the Lapsus$ group across multiple attacks.
▌Focus on Stealing Compromised Credentials
Microsoft tracks the Lapsus$ data extortion group as "DEV-0537" and stated they primarily focus on stealing compromised credentials to gain initial access to corporate networks.
These credentials are obtained through the following methods:
Deploying malicious Redline password stealers to obtain passwords and session tokens
Purchasing credentials and session tokens on underground forums
Buying credentials and multi-factor authentication (MFA) approvals from employees of target organizations (or vendors/business partners)
Searching for exposed credentials in public code repositories
The Redline password stealer has become the malware of choice for credential theft, often distributed via phishing emails, warez sites, and videos on YouTube. Once Lapsus$ gains access to stolen credentials, they log into the company's public-facing devices and systems, including VPNs, virtual desktop infrastructures, or identity management services, such as their intrusion into Okta in January, which affected over 300 customers.
Microsoft stated that they use session replay attacks against accounts using multi-factor authentication (MFA), or repeatedly trigger MFA notifications until users get tired of them and allow the login. Microsoft also stated that in at least one attack, Lapsus$ performed a SIM swap attack to take control of a user's phone number and SMS texts to obtain the MFA codes needed to log into accounts. Once access to the network is obtained, they use AD Explorer to find accounts with higher privileges, then target development and collaboration platforms such as SharePoint, Confluence, JIRA, Slack, and Microsoft Teams. They also use the stolen credentials to access source code repositories on GitLab, GitHub, and Azure DevOps, exploiting vulnerabilities in Confluence, JIRA, and GitLab to elevate privileges. Lapsus$ collects valuable data and exfiltrates it via NordVPN connections to hide their location, while conducting destructive attacks on the victim's infrastructure to trigger incident response processes. They then monitor these processes through the victim's Slack or Microsoft Teams channels.
▌How to Defend Against Lapsus$
Microsoft recommends that organizations take the following steps to defend against extortion groups like Lapsus$:
Strengthen the implementation of MFA
Establish healthy, trusted endpoints
Enable modern authentication in your VPN
Strengthen and monitor cloud security posture
Raise awareness of social engineering attacks
Establish special security operations response processes for DEV-0537
The Lapsus$ extortion group has succeeded repeatedly, acquiring countless pieces of confidential information and source code. In just a few months, the group high-profilely breached a series of well-known companies such as NVIDIA, Samsung, Ubisoft, Mercado Libre, and Vodafone, threatening to leak stolen data and source code to extort high ransoms. As can be seen from Microsoft's public blog post, the reason the Microsoft team was able to interrupt the attack in a timely manner was also due to the Lapsus$ group's public disclosure. Tech giants around the world seem to have no resistance against the Lapsus$ extortion group, with security defense systems proving practically useless. This is a shocking and thought-provoking fact: companies rarely pay attention to the actual effectiveness of their security defense systems when they have not suffered a major attack, often building a false sense of security through multiple security software and antivirus software. But when a real threat arrives, this illusory sense of security is immediately shattered by harsh reality, and even if enterprises invest heavily, they may not necessarily buy true security.
Therefore, after establishing and deploying a security defense system, another essential step for enterprises is to verify the effectiveness of the defense system. The verification process needs to recreate real attacks and intrusions as much as possible, without actually suffering a real threat. Security Validation tracks internet hacker groups and vulnerabilities round-the-clock, and utilizes the first-hand intelligence obtained to recreate attack methods in a timely manner, providing validation means for uncompromised enterprises.
New faces like the Lapsus$ group will surely continue to emerge in the future cybercrime field, and new attack methods will also catch more enterprises off guard. Security Validation hopes to help enterprises optimize their security defense systems and stay fully prepared to face threats at any time.
| Reference Sources
