The curious title LAPSUS$ made large headlines in March 2022 because the nickname of a hacking gang, or, in unvarnished phrases, because the label for a infamous and energetic collective of cybercriminals:
The title was considerably uncommon for a cybercrime crew, who generally undertake soubriquets that sound edgy and harmful, similar to DEADBOLT, Devil, Darkside, and REvil.
As we talked about again in March, nonetheless, lapsus is pretty much as good a contemporary Latin phrase as any for “knowledge breach”, and the trailing greenback signal signifies each monetary worth and programming, being the standard approach of denoting that BASIC variable is a textual content string, not a quantity.
The gang, workforce, crew, posse, collective, gaggle, name it what you’ll, of attackers apparently introduced an identical type of ambiguity of their cybercriminality.
Generally, they appeared to indicate that they had been critical about extorting cash or ripping off cryptocurrency from their victims, however at however at different instances they appeared merely to be displaying off.
Microsoft admitted on the time that it had been infiltrated by LAPSUS$, although the software program large referred to the group as DEV-5037, with the criminals apparently stealing gigabytes of supply code.
Okta, a 2FA service supplier, was one other high-profile sufferer, the place the hackers acquired RDP entry to an assist techie’s pc, and had been due to this fact in a position to entry a variety of Okta’s inside methods as in the event that they had been logged in on to Okta’s personal community.
That assist techie didn’t work for Okta, however for a corporation contracted by Okta, in order that the attackers had been basically in a position to breach Okta’s community with out breaching Okta itself.
Intriguingly, although Okta’s breach occurred in January 2022, neither Okta nor its contractor made any public admission of the breach for about two months, whereas a forensic examination occurred…
…till LAPSUS$ apparently determined to pre-empt any official announcement by dumping screenshots to “show” the breach, paradoxically on the exact same day that Okta obtained the ultimate forensic report from the contractor (how, or if, LAPSUS$ received advance warning of the report’s supply is unknown):
Subsequent on the assault docket was graphics chip vendor Nvidia, who apparently additionally suffered a knowledge heist, adopted by one of many weirdest ransomware-with-a-difference extortion calls for on file – open-source your graphics driver code, or else:
As we mentioned within the Bare Safety podcast (S3 Ep73):
Usually, the connection between cryptocurrency and ransomware is the crooks determine, “Go and purchase some cryptocurrency and ship it to us, and we’ll decrypt all of your recordsdata and/or delete your knowledge.” […]
However on this case, the reference to cryptocurrency was they mentioned, “We’ll overlook all in regards to the large quantity of knowledge we stole if you happen to open up your graphics playing cards in order that they will cryptomine at full energy.”
As a result of that goes again to a change that Nvidia made final 12 months [2021], which was very fashionable with players [by discouraging cryptominers from buying up all the Nvidia GPUs on the market for non-graphics purposes].
A special type of cybercriminal?
For all that the web actions attributed to LAPSUS$ have been significantly and unashamedly legal, the group’s post-exploitation behaviour typically appeared relatively old-school.
Not like right this moment’s multimillion-dollar ransomware attackers, whose main motivations are cash, cash and more cash, LAPSUS$ apparently aligned extra carefully with the virus-writing scene of the late Nineteen Eighties and Nineteen Nineties, the place assaults had been generally carried out merely for bragging rights and “for the lulz”.
(The phrase for the lulz interprets roughly as with a view to provoke insultingly mirthful laughter, primarily based on the acronym LOL, brief for “laughing out loud”.)
So, when the Metropolis of London Police introduced, simply two days after the not-so-mirthful-at-all screenshots of the Okta assault appeared, that it had arrested what appeared like a motley bunch of kids within the UK for allegedly being members of a hacking group…
…the world’s IT media shortly made a reference to LAPSUS$:
So far as we’re conscious, UK legislation enforcement has by no means used the phrase LAPSUS$ in reference to the suspects in that arrest, noting again in March 2022 merely that “our enquiries stay ongoing.”
However, an obvious hyperlink with LAPSUS$ was inferred from the truth that one of many children busted was mentioned to be 17 years outdated, and to hail from Oxfordshire in England.
Fascinatingly, a hacker of that age who allegedly lived in a city simply outdoors Oxford, the town from which the encompassing county will get its title, had been outed by a disgruntled cybercrime rival not lengthy earlier than, in what’s often called a doxxing.
Doxxing is the place a cybercriminal releases stolen private paperwork and particulars on goal, typically with a view to put a person prone to arrest by legislation enforcement, or at risk of retribution by ill-informed or malevolent opponents.
The doxxer leaked what he claimed was his rival’s dwelling tackle, along with private particulars and images of him and shut members of the family, in addition to a bunch of allegations that he was some form of linchpin within the LAPSUS$ crew.
LAPUS$ again within the highlight
As you may think about, the latest Uber hacking tales revived the title LAPSUS$, provided that the attacker in that case was extensively claimed to be 18 years outdated, and was apparently solely involved in displaying off:
As Chester Wisniewski defined in a latest podcast minisode:
[I]n this case, […] it appears to be “for the lulz”. […T]he one who did it was principally accumulating trophies as they bounced via the community – within the type of screenshots of all [the] totally different instruments and utilities and applications that had been in use round Uber – and posting them publicly, I suppose for the road cred.
Shortly after the Uber hack, practically an hour’s price of what appeared to be video clips from the forthcoming recreation GTA6, apparently display screen captures made for debugging and testing functions, had been leaked following an intrusion at Rockstar video games.
As soon as once more, the identical younger hacker, with the identical presumed connection to LAPSUS$, was implicated within the assault.
This time, reviews recommend that the hacker had extra in thoughts merely than bragging rights, allegedly saying that they had been “trying to negotiate a deal.”
So, when Metropolis of London Police tweeted earlier this week that they’d “arrested a 17-year-old in Oxfordshire on suspicion of hacking”…
On the night of Thursday 22 September 2022, the Metropolis of London Police arrested a 17-year-old in Oxfordshire on suspicion of hacking, as a part of an investigation supported by the @NCA_UK’s Nationwide Cyber Crime Unit (NCCU).
He stays in police custody. pic.twitter.com/Zfa3OlDR6J
— Metropolis of London Police (@CityPolice) September 23, 2022
…you may think about what conclusions the Twittersphere shortly reached.
It have to be the identical individual!
In any case, what’s the prospect that we’re speaking about two totally different and unconnected suspects right here?
The one factor we don’t know is sort of the place the LAPSUS$ moniker comes into it, if certainly it’s concerned in any respect.
O, what a tangled net we weave/When first we practise to deceive.
LEARN HOW TO AVOID LAPSUS$-STYLE ATTACKS
Click on-and-drag on the soundwaves under to skip to any level. You may also hear immediately on Soundcloud.
Here is a method we predict you may estimate the chance that the suspect within the two arrests is identical individual. We'd like P, the inhabitants of Oxfordshire. (We assume that by saying "Oxfordshire", the police considerably parochially meant "the county districts excluding Oxford Metropolis within the centre of the area", or else they'd have merely mentioned he was "from Oxford".) We'd like A, an estimate of the proportion of individuals in the area who're at the moment aged 17. We'd like M, an estimate of the proportion of males within the inhabitants. (The police tweet says "he's in custody".) Then we now have to strive to determine, from that particular cohort of individuals, the next chances: F = Prob(these with the wanted endurance and abilities and who're actively into legal hacking) G = Prob(legal hackers of this sort within the area who get caught) H = Prob(those that proceed hacking and bragging after getting bail for doing simply that) Based mostly on native authorities census knowledge and country-wide age statistics, we get: P = 563,000 (Cherwell District + Vale of White Horse + West Oxon + South Oxon) A = 0.05 (5%) M = 0.5 (one half, or 50%) F = 0.01 (1%) G = 0.10 (10%) H = 0.10 (10%) You possibly can plug in your individual estimates for the above (our 5% for 17-year-olds band might be too excessive, because the stats we used solely have a band protecting 15-17) however we labored out the scale of the set merely as: P×A×M×F×G×H. With our guesses, you get 563,000 × 5% × 50% × 1% × 10% × 10% That comes out at 1.4 individuals. We expect that is a 70% (1/1.4) likelihood it is the identical individual. Inhabitants: https://perception.oxfordshire.gov.uk/cms/inhabitants Demography: https://www.ethnicity-facts-figures.service.gov.uk/uk-population-by-ethnicity/demographics/age-groups/newest
