Microsoft Shares Details On Lapsus$ Hacking Operations

Microsoft has uncovered the activities of Lapsus$, a relatively new hacking group conducting cyberattacks against organizations.

According to Microsoft, Lapsus$ dubbed DEV-0537 uses an extortion and destruction model of attack. This model does not rely on ransomware payloads.

The group employs different social engineering schemes to lure potential victims. This includes phone-based social engineering via SIM-swapping and compromising an individual’s personal or private accounts.

Other tactics include deceiving the company’s support representatives into divulging secrets and carrying out an alliance with employees to gain access to account credentials and MFA details.

The group also purchases credentials and tokens from forums on the Dark Web, scans public code repositories for exposed credentials, and uses a password stealer known as Redline to capture passwords and tokens.

Organizations are advised to protect themselves by requiring MFA for all users, avoiding telephone-based and SMS-based MFA, using Azure AD password protection, and using other password authentication tools.

Others include reviewing their VPN authentication, monitoring and reviewing their cloud security, educating all employees about social engineering attacks, and setting up security processes in response to possible Lapsus$ intrusions.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web