Microsoft confirms they were hacked by Lapsus$ extortion group

Microsoft has confirmed that 1 of their workforce was compromised by the Lapsus$ hacking group, permitting the threat actors to access and steal portions of their supply code.

Very last evening, the Lapsus$ gang released 37GB of resource code stolen from Microsoft’s Azure DevOps server. The resource code is for numerous inside Microsoft assignments, which include for Bing, Cortana, and Bing Maps.

In a new weblog publish revealed tonight, Microsoft has verified that one of their employee’s accounts was compromised by Lapsus$, supplying restricted obtain to supply code repositories.

“No buyer code or information was associated in the noticed actions. Our investigation has found a solitary account had been compromised, granting constrained access. Our cybersecurity response teams promptly engaged to remediate the compromised account and prevent even further exercise,” spelled out Microsoft in an advisory about the Lapsus$ threat actors.

“Microsoft does not rely on the secrecy of code as a protection measure and viewing supply code does not lead to elevation of risk. The methods DEV-0537 made use of in this intrusion replicate the practices and strategies reviewed in this weblog.”

“Our group was now investigating the compromised account primarily based on threat intelligence when the actor publicly disclosed their intrusion. This public disclosure escalated our action making it possible for our team to intervene and interrupt the actor mid-procedure, restricting broader influence.”

Though Microsoft has not shared how the account was compromised, they provided a standard overview of the Lapsus gang’s techniques, strategies, and techniques (TTPs) noticed throughout a number of attacks.

Concentrating on compromised credentials

Microsoft is monitoring the Lapsus$ data extortion team as ‘DEV-0537’ and says they generally emphasis on acquiring compromised qualifications for original access to company networks.

These credentials are received utilizing the following approaches:

• Deploying the destructive Redline password stealer to get passwords and session tokens
• Purchasing qualifications and session tokens on prison underground message boards
• Having to pay staff members at focused companies (or suppliers/business associates) for access to credentials and multi-issue authentication (MFA) approval
• Browsing community code repositories for exposed credentials

Redline password stealer has become the malware of choice for stealing credentials and is commonly dispersed by means of phishing email messages, watering holes, warez internet sites, and YouTube films.

The moment Laspsus$ gains accessibility to compromised credentials, they use it to log in to a firm’s community-going through products and methods, which includes VPNs, Digital Desktop infrastructure, or id administration products and services, this sort of as Okta, which they breached in January.

Microsoft claims they use session replay assaults for accounts that use MFA, or continuously cause MFA notifications right until the person becomes drained of them and confirms that the consumer ought to be allowed to log in.

Microsoft claims that in at the very least 1 assault, Lapsus$ done a SIM swap assault to acquire regulate of the user’s cellphone figures and SMS texts to gain entry to MFA codes needed to log in to an account.

As soon as they obtain obtain to a network, the danger actors use Advertisement Explorer to locate accounts with better privileges and then goal advancement and collaboration platforms, these as SharePoint, Confluence, JIRA, Slack, and Microsoft Groups, in which other credentials are stolen. 

The hacking group also utilizes these credentials to gain accessibility to source code repositories on GitLab, GitHub, and Azure DevOps, as we noticed with the attack on Microsoft.

“DEV-0537 is also regarded to exploit vulnerabilities in Confluence, JIRA, and GitLab for privilege escalation,” Microsoft explains in their report.

“The group compromised the servers managing these apps to get the credentials of a privileged account or run in the context of the said account and dump credentials from there.”

The danger actors will then harvest beneficial information and exfiltrate it around NordVPN connections to conceal their places although carrying out destructive assaults on the victims’ infrastructure to result in incident reaction processes. 

The threat actors then check these methods through the victim’s Slack or Microsoft Teams channels.

Protecting from Lapsus$

Microsoft suggests that company entities complete the adhering to methods to secure against menace actors like Lapsus$:

• Strengthen MFA implementation
• Have to have Wholesome and Reliable Endpoints
• Leverage modern day authentication possibilities for VPNs
• Fortify and keep track of your cloud security posture
• Enhance awareness of social engineering assaults
• Set up operational protection processes in response to DEV-0537 intrusions

Lapsus$ has recently carried out quite a few attacks in opposition to the organization, together with people against NVIDIA, Samsung, Vodafone, Ubisoft, Mercado Libre, and now Microsoft.

Therefore, it is strongly advised that protection and network admins come to be common with the practices used by this group by examining Microsoft’s report.