8 ms·

This is wild. What is the psychology behind this group? If they're not deploying ransomware, it seems like their purpose is to penetrate companies "because they

by daenz 5y ago

This is wild. What is the psychology behind this group? If they're not deploying ransomware, it seems like their purpose is to penetrate companies "because they can." Publicly offering to pay employees for credentials is a dynamic that I've never heard, and in a rule-less game, seems like it breaks new rules.

learndeeply 5y ago
It's not ransomware, but just extortion. Pay up or your files will be released. https://www.wired.com/story/lapsus-hacking-group-extortion-nvidia-samsung/ https://www.wired.com/story/lapsus-hacking-group-extortion-n...
staticautomatic 5y ago
What’s especially scary is the possibility that any employee whose credentials are stolen may be investigated for conspiracy.
encryptluks2 5y ago
Seems like maybe there is some political ambitions behind the group. Maybe anarchy aspirations?
mardifoufs 5y ago
Yeah they are selling some of the exploits (the low hash rate enable on nvidia cards) but even then they say that with what they released it up until now it would be possible to figure out the way to do it by yourself. So the "for the lulz" element is very much central to their breaches and honestly that's a bit... refreshing? Not that I side with them or anything, but this is definitely more fun than ransomware.
- beebmam 5y ago
  "for the lulz" is always about plausible deniability
  - Cthulhu_ 5y ago
    Yup; the Russian hacker groups are supposedly independent, Anonymous is supposedly independent, but there's probably some pretty big overlaps in Venn diagrams if you look closer.
    - nivenkos 5y ago
      I used to be on an IRC server that ran a honeypot to then find actual compromised servers and check them out - IIRC there were Ecuadorean government servers, and a load of routers in India, etc. Most of it was just malware analysis and people creating pubstro servers for fun with different communities. Not everything is Reds under the bed.
    - rolph 5y ago
      its like superfriends, everyone has thier own gig and support each other when crossing paths, but the hall of justice/legion of doom is the muster point when SHTF
  - sodality2 5y ago
    Why? It's not like saying "for the lulz" will help them when being prosecuted.
- fxtentacle 5y ago
  Or maybe they just want stuff for themselves and then uploaded it for the lulz? I've heard of someone who completely reverse engineered the iTunes DRM just because he wanted to download 4K to watch the series that he had "bought" from Apple offline on his TV. It's more of a myth because that person refuses to release source code or details, but then again that is probably a sane decision. Still, I would be willing to believe that someone would do that just because they themselves feel irritated by the DRM. Add a bit of youthful rakishness and someone might then upload the result to bittorrent, just because they can and don't care, i.e. "for the lulz".
- DyslexicAtheist 5y ago
  > Not that I side with them or anything, but this is definitely more fun than ransomware. I don't side with them. In the grand scheme of things they did open my eyes to the terrible IR processes of a much hyped company (okta), and they exposed how poor their product is/was. Security companies should be held to a higher standard when discussing breaches and IR. okta very much deserved it (and so does microsoft a 1000x). I don't endorse it but I can't hide my Schadenfreude either.
octoberfranklin 5y ago
I think they're a smokescreen for some state-sponsored group. LAPSUS$ grabs the headlines, sows chaos, keeps security teams fighting fires. Meanwhile the truly important attacks proceed with great stealth.
- 0xy 5y ago
  If it's state-sponsored the number of nations is pretty limited. They attacked Brazilian government infrastructure, which rules out Russia, US, Israel and China who all maintain strong Brazilian relations. That doesn't leave very many actors capable or willing to do this. They also use Brazilian slang, which granted could just be disinfo to throw people off.
  - Adrox 5y ago
    They also attacked at least a newspaper in Portugal ( expresso.pt) and some government agencies.
  - mschuster91 5y ago
    Israeli and the US' secret services doesn't care about allies or strong relations. They do whatever they deem necessary to do their job and both have been caught red-handed multiple times.
  - toyg 5y ago
    There are no friends in the spy game; this should have become abundantly clear after the revelations on US tapping the German chancellor as a matter of routine. There might well be something that, say, some US interests want and Brazilian entities are not willing to share. Enter a bit of XXI century spycraft, and everyone is happy. This said, it seems a bit too exposed to be an intelligence op, even as diversion. Even if misdirecting, it is raising alarms and improving the security posture of the affected organisations afterwards, which you typically wouldn't want as a spook. You want to put down invisible roots, to let everyone sleep soundly while you go about your business undetected. To me this looks like an average gang with slightly above-average tech skills, drunk on their own success - with a mindset to "get rich, or die trying".
chrismarlow9 5y ago
Drain cryptocurrency accounts and use money to buy shares in companies who's financials you have access to. Sell your data to private bidders. Plenty of ways to make money without ransomware.
- alexb_ 5y ago
  Using stock trading is a TERRIBLE idea, that's how you get caught. SEC doesn't play around. I doubt they are doing that, private bidders seems way more likely.
  - ushakov 5y ago
    they could have someone else hold the stock for them
    - alexb_ 5y ago
      any way you can think of to get around insider trading the SEC knows about. people try this stuff all the time lol
      - theysus 5y ago
        They really don’t and you’re just promoting the same mystical thinking about how the NSA / FBI / CIA is totally wiretapping us all and knows all our details. Ask yourself the solve rate on most serious crime on the US. While the SEC has “algorithms” to look for insider trading, it’s most relying on folks with bad OPSEC bragging and getting turned in by bitter third-parties. Source: worked for Thesys / Thesys CAT group before our fucktard brass lost us the contract.
      - belter 5y ago
        Getting around SEC insider trading rules? Easy peasy lemon squeezy: "58 members of Congress have violated a law designed to stop insider trading and prevent conflicts-of-interest" https://www.businessinsider.com/congress-stock-act-violations-senate-house-trading-2021-9?international=true&r=US&IR=T https://www.businessinsider.com/congress-stock-act-violation...
p410n3 5y ago
Reminds me of what deletescape and their associates did. They just broke into stuff and leaked it. There's lots of tweets and telegram messages explaining their motives. Now most of the tweets and telegram messages are deleted but there's still some to see in article's and even in the FBI indictment. Tillie had TERRIBLE opsec from day one tho. Everyone knew her real name and face. I once mentioned this in the group chat and she promptly tweeted a selfie saying "don't have opsec like me". Considering this, it lastes pretty long actually. Disclaimer: I was in no way involved and publicly stated my disapproval in the deletescape Chats. It was however a thrill to see these things go down. Although it is equally as sad how this young lady threw away a lot of future potential for her ideals, without making any significant changes imo
shp0ngle 5y ago
Look at their telegram. They seem to be someone who is clearly inexperienced and support "hacker ethos" and don't really know what they want. They started talking about "demanding" code under open source licenses and stuff like that.... I think they are just some young hackers that started punching above their weight, and something will happen to them sooner or later. But let's see
- Cthulhu_ 5y ago
  I find it hard to believe that someone who is "clearly inexperienced" has managed to do a lot of high-level hacks in a short amount of time; I mean if someone who is "clearly inexperienced" has the capacity to do all that, we are so fucked.
  - moritonal 5y ago
    Never underestimate how much time, energy, and a total lack of care for rules a university student has, whilst simultaneously looking for something to prove[1] 1. https://en.wikipedia.org/wiki/LulzSec https://en.wikipedia.org/wiki/LulzSec
    - unobatbayar 5y ago
      A university student has much higher ethical and moral grounds than a criminal actor. Their something to prove rarely involves criminal activity.
      - dvdkon 5y ago
        Leaking data isn't petty crime. I can believe a student with anti-corporate views could see what LAPSUS$ are doing as a good thing. Or just a student who is good at cracking and wants to show off, criminality be damned.
      - mananaysiempre 5y ago
        From what I understand (IANAL), the bar for what constitutes criminal activity with computers is very, very low. As in, arguably the recent post by Julia Evans on undocumented web APIs[1] is a tutorial on performing criminal acts. Which is not a judgment on whether LAPSUS$ is doing genuinely bad stuff—I don’t know—only to say that, when computers are involved, “criminal” not only doesn’t make a good consensus point on avoiding a slippery slope into overall badness, it doesn’t even seem to make a good heuristic on whether something is bad or not. [1] https://jvns.ca/blog/2022/03/10/how-to-use-undocumented-web-apis/ https://jvns.ca/blog/2022/03/10/how-to-use-undocumented-web-...
belter 5y ago
Should be part of your threat modelling so no, not a new dynamic. "Threat Landscape and Good Practice Guide for Internet Infrastructure" [PDF]: https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-thematic-landscapes/threat-landscape-of-the-internet-infrastructure/threat-mind-map/@@download/file/Threat%20Mind%20Map.pdf https://www.enisa.europa.eu/topics/threat-risk-management/th...
- mrspuratic 5y ago
  Useful list, thanks. I rather suspect "sharks" as a cause of damage or loss to IT assets is either an easter egg or a mis-translation...
  - belter 5y ago
    Not really, it's under Damage to IT Assets :-) "How Google Stops Sharks From Eating Undersea Cables": https://www.forbes.com/sites/amitchowdhry/2014/08/15/how-google-stops-sharks-from-eating-undersea-cables/?sh=1262e98a1f2b https://www.forbes.com/sites/amitchowdhry/2014/08/15/how-goo...
    - mrspuratic 5y ago
      I stand corrected :)
    - randomswede 5y ago
      Sharks, cats, possums, bored rural people with shotguns, a rockslide in the wrong valley in South America (there's pretty much just one pass that all east/west SA traffic passes through). All of these are things that occasionally take out either comms, or data centres on a semi-regular basis.
deleted 5y ago
[deleted]

by daenz 5y ago

learndeeply 5y ago

It's not ransomware, but just extortion. Pay up or your files will be released. https://www.wired.com/story/lapsus-hacking-group-extortion-nvidia-samsung/ https://www.wired.com/story/lapsus-hacking-group-extortion-n...

staticautomatic 5y ago

What’s especially scary is the possibility that any employee whose credentials are stolen may be investigated for conspiracy.

encryptluks2 5y ago

Seems like maybe there is some political ambitions behind the group. Maybe anarchy aspirations?

mardifoufs 5y ago

Yeah they are selling some of the exploits (the low hash rate enable on nvidia cards) but even then they say that with what they released it up until now it would be possible to figure out the way to do it by yourself. So the "for the lulz" element is very much central to their breaches and honestly that's a bit... refreshing? Not that I side with them or anything, but this is definitely more fun than ransomware.

beebmam 5y ago
"for the lulz" is always about plausible deniability
- Cthulhu_ 5y ago
  Yup; the Russian hacker groups are supposedly independent, Anonymous is supposedly independent, but there's probably some pretty big overlaps in Venn diagrams if you look closer.
  - nivenkos 5y ago
    I used to be on an IRC server that ran a honeypot to then find actual compromised servers and check them out - IIRC there were Ecuadorean government servers, and a load of routers in India, etc. Most of it was just malware analysis and people creating pubstro servers for fun with different communities. Not everything is Reds under the bed.
  - rolph 5y ago
    its like superfriends, everyone has thier own gig and support each other when crossing paths, but the hall of justice/legion of doom is the muster point when SHTF
- sodality2 5y ago
  Why? It's not like saying "for the lulz" will help them when being prosecuted.
fxtentacle 5y ago
Or maybe they just want stuff for themselves and then uploaded it for the lulz? I've heard of someone who completely reverse engineered the iTunes DRM just because he wanted to download 4K to watch the series that he had "bought" from Apple offline on his TV. It's more of a myth because that person refuses to release source code or details, but then again that is probably a sane decision. Still, I would be willing to believe that someone would do that just because they themselves feel irritated by the DRM. Add a bit of youthful rakishness and someone might then upload the result to bittorrent, just because they can and don't care, i.e. "for the lulz".
DyslexicAtheist 5y ago
> Not that I side with them or anything, but this is definitely more fun than ransomware. I don't side with them. In the grand scheme of things they did open my eyes to the terrible IR processes of a much hyped company (okta), and they exposed how poor their product is/was. Security companies should be held to a higher standard when discussing breaches and IR. okta very much deserved it (and so does microsoft a 1000x). I don't endorse it but I can't hide my Schadenfreude either.

octoberfranklin 5y ago

I think they're a smokescreen for some state-sponsored group. LAPSUS$ grabs the headlines, sows chaos, keeps security teams fighting fires. Meanwhile the truly important attacks proceed with great stealth.

0xy 5y ago
If it's state-sponsored the number of nations is pretty limited. They attacked Brazilian government infrastructure, which rules out Russia, US, Israel and China who all maintain strong Brazilian relations. That doesn't leave very many actors capable or willing to do this. They also use Brazilian slang, which granted could just be disinfo to throw people off.
- Adrox 5y ago
  They also attacked at least a newspaper in Portugal ( expresso.pt) and some government agencies.
- mschuster91 5y ago
  Israeli and the US' secret services doesn't care about allies or strong relations. They do whatever they deem necessary to do their job and both have been caught red-handed multiple times.
- toyg 5y ago
  There are no friends in the spy game; this should have become abundantly clear after the revelations on US tapping the German chancellor as a matter of routine. There might well be something that, say, some US interests want and Brazilian entities are not willing to share. Enter a bit of XXI century spycraft, and everyone is happy. This said, it seems a bit too exposed to be an intelligence op, even as diversion. Even if misdirecting, it is raising alarms and improving the security posture of the affected organisations afterwards, which you typically wouldn't want as a spook. You want to put down invisible roots, to let everyone sleep soundly while you go about your business undetected. To me this looks like an average gang with slightly above-average tech skills, drunk on their own success - with a mindset to "get rich, or die trying".

chrismarlow9 5y ago

Drain cryptocurrency accounts and use money to buy shares in companies who's financials you have access to. Sell your data to private bidders. Plenty of ways to make money without ransomware.

alexb_ 5y ago
Using stock trading is a TERRIBLE idea, that's how you get caught. SEC doesn't play around. I doubt they are doing that, private bidders seems way more likely.
- ushakov 5y ago
  they could have someone else hold the stock for them
  - alexb_ 5y ago
    any way you can think of to get around insider trading the SEC knows about. people try this stuff all the time lol
    - theysus 5y ago
      They really don’t and you’re just promoting the same mystical thinking about how the NSA / FBI / CIA is totally wiretapping us all and knows all our details. Ask yourself the solve rate on most serious crime on the US. While the SEC has “algorithms” to look for insider trading, it’s most relying on folks with bad OPSEC bragging and getting turned in by bitter third-parties. Source: worked for Thesys / Thesys CAT group before our fucktard brass lost us the contract.
    - belter 5y ago
      Getting around SEC insider trading rules? Easy peasy lemon squeezy: "58 members of Congress have violated a law designed to stop insider trading and prevent conflicts-of-interest" https://www.businessinsider.com/congress-stock-act-violations-senate-house-trading-2021-9?international=true&r=US&IR=T https://www.businessinsider.com/congress-stock-act-violation...

p410n3 5y ago

Reminds me of what deletescape and their associates did. They just broke into stuff and leaked it. There's lots of tweets and telegram messages explaining their motives. Now most of the tweets and telegram messages are deleted but there's still some to see in article's and even in the FBI indictment. Tillie had TERRIBLE opsec from day one tho. Everyone knew her real name and face. I once mentioned this in the group chat and she promptly tweeted a selfie saying "don't have opsec like me". Considering this, it lastes pretty long actually. Disclaimer: I was in no way involved and publicly stated my disapproval in the deletescape Chats. It was however a thrill to see these things go down. Although it is equally as sad how this young lady threw away a lot of future potential for her ideals, without making any significant changes imo

shp0ngle 5y ago

Look at their telegram. They seem to be someone who is clearly inexperienced and support "hacker ethos" and don't really know what they want. They started talking about "demanding" code under open source licenses and stuff like that.... I think they are just some young hackers that started punching above their weight, and something will happen to them sooner or later. But let's see

Cthulhu_ 5y ago
I find it hard to believe that someone who is "clearly inexperienced" has managed to do a lot of high-level hacks in a short amount of time; I mean if someone who is "clearly inexperienced" has the capacity to do all that, we are so fucked.
- moritonal 5y ago
  Never underestimate how much time, energy, and a total lack of care for rules a university student has, whilst simultaneously looking for something to prove[1] 1. https://en.wikipedia.org/wiki/LulzSec https://en.wikipedia.org/wiki/LulzSec
  - unobatbayar 5y ago
    A university student has much higher ethical and moral grounds than a criminal actor. Their something to prove rarely involves criminal activity.
    - dvdkon 5y ago
      Leaking data isn't petty crime. I can believe a student with anti-corporate views could see what LAPSUS$ are doing as a good thing. Or just a student who is good at cracking and wants to show off, criminality be damned.
    - mananaysiempre 5y ago
      From what I understand (IANAL), the bar for what constitutes criminal activity with computers is very, very low. As in, arguably the recent post by Julia Evans on undocumented web APIs[1] is a tutorial on performing criminal acts. Which is not a judgment on whether LAPSUS$ is doing genuinely bad stuff—I don’t know—only to say that, when computers are involved, “criminal” not only doesn’t make a good consensus point on avoiding a slippery slope into overall badness, it doesn’t even seem to make a good heuristic on whether something is bad or not. [1] https://jvns.ca/blog/2022/03/10/how-to-use-undocumented-web-apis/ https://jvns.ca/blog/2022/03/10/how-to-use-undocumented-web-...

belter 5y ago

Should be part of your threat modelling so no, not a new dynamic. "Threat Landscape and Good Practice Guide for Internet Infrastructure" [PDF]: https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-thematic-landscapes/threat-landscape-of-the-internet-infrastructure/threat-mind-map/@@download/file/Threat%20Mind%20Map.pdf https://www.enisa.europa.eu/topics/threat-risk-management/th...

mrspuratic 5y ago
Useful list, thanks. I rather suspect "sharks" as a cause of damage or loss to IT assets is either an easter egg or a mis-translation...
- belter 5y ago
  Not really, it's under Damage to IT Assets :-) "How Google Stops Sharks From Eating Undersea Cables": https://www.forbes.com/sites/amitchowdhry/2014/08/15/how-google-stops-sharks-from-eating-undersea-cables/?sh=1262e98a1f2b https://www.forbes.com/sites/amitchowdhry/2014/08/15/how-goo...
  - mrspuratic 5y ago
    I stand corrected :)
  - randomswede 5y ago
    Sharks, cats, possums, bored rural people with shotguns, a rockslide in the wrong valley in South America (there's pretty much just one pass that all east/west SA traffic passes through). All of these are things that occasionally take out either comms, or data centres on a semi-regular basis.

deleted 5y ago

[deleted]