March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – InvisiMole – Active IOCs – Russian-Ukrainian Cyber Warfare
March 22, 2022
Rewterz Threat Update – Threat Intelligence Insights – 23rd March
March 23, 2022
Rewterz Threat Alert – InvisiMole – Active IOCs – Russian-Ukrainian Cyber Warfare
March 22, 2022
Rewterz Threat Update – Threat Intelligence Insights – 23rd March
March 23, 2022
Severity
High
Analysis Summary
LAPSUS$ Ransomware is a new and emerging ransomware group that has successfully attacked major conglomerate. Like most ransomware groups, LAPSUS$ also infiltrates organizations with a phishing attack. From there on, they exploit vulnerabilities like privilege escalation to get hold of administrative rights and blatantly display their abilities. LAPSUS$ Threat group has allegedly breached Okta. This news comes in the same week when the group announced their infiltration of Microsoft’s Azure DevOps. If the shared screenshots are true, then LAPSUS$ has access to Microsoft’s internal source-code repositories. 
The gang has previously (allegedly) compromised NVIDIA, Samsung, Vodafone, Mercado Libre, and Ubisoft. They have also started a recruitement campaign for insiders employeed at conglomorates like Microsoft, Apple, and IBM.
Now, the LAPSUS$ group has shared screenshots that provide legitimacy to their claim that they have breached Okta.
Okta is an IDaaS (Identity as a Service) platform that is used to secure employee and customer identities. Big names like Hitachi, T-Mobile, HP, and Siemens use Okta. The worst part is, if the screenshots hsraed by LAPSUS$ are real, that means that the group breached Okta 2 months ago and has had access ever since.
Impact
- Financial Theft
- Data Breach
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.