Esme brings a wealth of knowledge and experience to our website, specializing in all aspects of DarkWeb security. With a deep understanding of the intricate workings of the DarkWeb and its associated cybersecurity risks, Esme curates insightful and informative content for our readers.
Latest posts by Esme Greene (see all)
- Lapsus$: Next-Level SIM-Swapping - September 8, 2023
- Russian Hackers in UK Election - September 8, 2023
- MOVEit Hacks: Industry’s Lesson - September 7, 2023
An enlightening study from the U.S. government has been made public, illuminating the strategies used by the Lapsus$ extortion ring to compromise highly secure enterprises. The specifics are covered in this article.
Cyber Shockwaves: Lessons from Lapsus$ Extortion
With its sophisticated assaults, the Lapsus$ extortion organization shocked the cybersecurity environment and gave the software sector a crucial lesson. Targets of the group’s operations, which took place between 2021 and 2022, included well-known corporations including Microsoft, Cisco, Okta, and others.
In its attacks, Lapsus$ combined simplicity and ingenuity. This loosely coordinated gang, primarily made up of young people from the UK and Brazil, used methods like SIM swapping to expose weaknesses in our cyber infrastructure.
One of their main strategies was SIM swapping, which allowed them to get into a company’s internal network and steal private data. They might intercept SMS-based two-factor authentication codes, allowing access to business services, by moving the individual’s phone number to a SIM card under their authority.
The Lapsus$ activities were examined by the DHS’s Cyber Safety Review Board, which emphasized that their inexpensive methods highlighted gaps in our digital defenses.
In addition to taking advantage of technological flaws, Lapsus$ also used insider knowledge, social engineering, and bogus EDRs to gather victim information.
This paper emphasizes the value of taking preventative actions against online dangers. The results emphasize the need for more robust telecom provider monitoring, cooperation with law enforcement, and stronger authentication techniques. It’s also advised to switch to password-free settings and implement a zero-trust policy.
Even if Lapsus$ hasn’t been heard from since September 2022, their legacy emphasizes the importance of ongoing watchfulness and teamwork in the fight against cybercriminals.