3 ms·
"Our team was already investigating the compromised account based on threat intelligence when the actor publicly disclosed their intrusion. This public disclosu
by fxtentacle 5y ago
"Our team was already investigating the compromised account based on threat intelligence when the actor publicly disclosed their intrusion. This public disclosure escalated our action allowing our team to intervene and interrupt the actor mid-operation, limiting broader impact."
Does that mean that Microsoft only managed to stop the hack-in-progress because LAPSUS publicly bragged about hacking Microsoft?
- ratg13 5y agoIt reads like they were trying to catch the employee in the act of doing something nefarious.
- toyg 5y agoProbably they were monitoring the behaviour of certain accounts to find all systems that intruders had compromised.
- rolph 5y agothis says something about how MS rolls out,,, it seems they sniff around first and get info, rather than just kill the account and its processes.
- q1w2 5y agoMS is keeping the details intentionally vague, so it's unlikely we'll ever know the scope of the breach and data exfiltration.