IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Leaked report on Okta breach reveals finer details of LAPSUS$ operation

Poor OPSEC and publicly available hacking tools allowed the hackers to pull off one of the most high-profile cyber attacks of the year so far

Elements of cyber security company Mandiant’s report into the Sitel breach that led to the compromise of identity platform Okta earlier in March has been leaked online, revealing the finer details of LAPSUS$’ operation.

Sitel retained Mandiant shortly after discovering the breach and a timeline of events was illustrated by a collection of logs included in Mandiant’s report. The timeline showed LAPSUS$ downloading hacking tools straight from the web and other revelations like Sitel seemingly storing domain passwords in an Excel spreadsheet.

Analysis by independent security researcher Bill Demirkapi suggested this spreadsheet may have allowed LAPSUS$ to create a backdoor in Sitel’s environment. Sitel did not respond to IT Pro’s request for comment on this and Manditant declined to provide any further input.

LAPSUS$ used publicly available tools downloaded from GitHub to facilitate its attack, Mandiant’s report indicated, including Mimikatz - a popular tool for harvesting credentials on Windows machines.

The first recorded remote desktop protocol (RDP) connection using the affected third-party support engineer’s account was made on the 19th of January, indicating this is when LAPSUS$ first gained access to Sitel.

IT Pro asked Sitel why it did not alert its customers to the breach at the time, but it did not reply at the time of publication.

Related Resource

Busting the myths about SSO

Why SSO capability is critical to the success of IAM

Pixelated black and white image with whitepaper title above on white backgroundFree download

LAPSUS$ was able to simply download Mimikatz, which has been used in high-profile cyber attacks such as NotPetya, simply from its official GitHub page and run it after disabling FireEye’s endpoint protection.

Mimikatz was used in LAPSUS$ initial reconnaissance phase of the attack and the credentials harvested using the tool allowed the group to establish a foothold and escalate its privileges in Sitel’s network. 

Mandiant’s report also indicated that LAPSUS$ concluded its objective by setting email transport rules to forward all incoming and outgoing email in Sitel’s environment, an observation previously highlighted by Microsoft

Demirkapi was subsequently released from his offensive security position at Zoom for publishing the intrusion timeline from Mandiant’s report, sparking outcry in the cyber security community.

IT Pro asked Zoom for an explanation of Demirkapi’s sacking but it did not reply.

LAPSUS$ is the hacking group that was behind major breaches of high-profile companies including Nvidia, Samsung, Microsoft, and LG. 

Shortly after LAPSUS$ announced its breach of Sitel and Okta via its Telegram channel on 22 March, UK law enforcement made a number of arrests in connection with the breach.

Seven individuals aged between 16 and 21 years were arrested on 24 March. All were released but investigations are ongoing.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021
ProtectedBy.AI’s CodeLock blocks malware at source code level
software as a service (SaaS)

ProtectedBy.AI’s CodeLock blocks malware at source code level

9 Jun 2021

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
Researchers demonstrate how to install malware on iPhone after it's switched off
Security

Researchers demonstrate how to install malware on iPhone after it's switched off

18 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022