5 ms·

I was researching cybercrime for years and yea motivations of this adversary are confusing and incoherent so I would rather say they are group of real life and/

I was researching cybercrime for years and yea motivations of this adversary are confusing and incoherent so I would rather say they are group of real life and/or internet friends who are having fun showing off and practicing their skills something like hackers who deface websites "en masse". From what Microsoft said DEV-0537 is opportunistic; they are Purchasing credentials and session tokens from criminal underground forums Paying employees at targeted organizations (or suppliers/business partners) for access to credentials and MFA approval Searching public code repositories for exposed credentials and they are exploiting publicly known exploits in order to infiltrate organizations. Like somebody already mentioned they are similar to LulzSec in a way they are partially financially motivated, partially hacktivist and partially bragging around but all in all they are doing it for the "lulz".

ianhawes 5y ago
I guarantee this is a group of less than 8, most of whom are under 23 and grew up in middle-class Brazilian families and have had access to computers (unfiltered and unmoderated) since age 10.
- smilespray 5y ago
  That's interestingly specific...
  - notuger 5y ago
    the telegram channel name is related to a big hack activity in brazil last year, they always share brazilian news..
    - chockchocschoir 5y ago
      It's also a relatively easy, cheap and common opsec strategy to mask your geographic location by constantly sharing news from a place you're not actually located at. Same as saying "good morning" every day to your "team" when actually it's night at your location.
      - toyg 5y ago
        TFA said they started by targeting South American organisations, it tallies that they could be Brazilian.
      - michaelcampbell 5y ago
        I read years ago that the US "SEAL Team 6" was named to throw off adversaries (primarily Russia at the time; maybe again now?) that the US actually HAD at least 6 SEAL teams.
    - bgroat 5y ago
      This is reminding me of L in Death Note describing how he tracked Kira down to a particular Japanese neighborhood
  - mrkramer 5y ago
    "Lapsus$ emerged just a few months ago, at first focused almost exclusively on Portuguese-language targets. In December and January, the group hacked and attempted to extort Brazil’s health ministry, the Portuguese media giant Impresa, the South American telecoms Claro and Embratel, and Brazilian car rental company Localiza, among others. In some cases, Lapsus$ also mounted denial-of-service attacks against victims, making their sites and services unavailable for a period of time[0]." [0] https://archive.ph/20220322060734/https://www.wired.com/story/lapsus-hacking-group-extortion-nvidia-samsung/ https://archive.ph/20220322060734/https://www.wired.com/stor...
toyg 5y ago
Microsoft: "these are bad guys motivated by theft and destruction, practicing extortion as a business model" HN: "These are kids doing it for the lulz" I'm hardly a MS supporter, but the facts seem to be on MS side here. The minute you pay somebody to gather access and then proceed to blackmail the organisation, you are organized crime. Just because they brag about it, it doesn't mean they're in it for the fun; they just think they are untouchable because they're outside US territory. It is somewhat sad that this can even be considered "hacktivism" these days. Extortion has nothing to do with activism.
- andybak 5y ago
  > partially financially motivated, partially hacktivist and partially bragging around Didn't you slightly oversimplify there?
  - mrkramer 5y ago
    They are impossible to decipher because their demands are changing[0]. Their extortion of Nvidia: "Remove a feature known as LHR, short for "Lite Hash Rate," or see the further leaking of stolen data." "We decided to help mining and gaming community," Lapsus$ members wrote in broken English. "We want nvidia to push an update for all 30 series firmware that remove every lhr limitations otherwise we will leak hw folder. If they remove the lhr we will forget about hw folder (it's a big folder). We both know lhr impact mining and gaming." "Lapsus$ modified its demand. Now, the group also wants Nvidia to commit to making its GPU drivers completely open source. If Nvidia does not comply, Lapsus$ says, the company can expect to see a new leak that would include the complete silicon, graphics, and computer chipset files for all its recent GPUs." [0] https://arstechnica.com/information-technology/2022/03/cybercriminals-who-breached-nvidia-issue-one-of-the-most-unusual-demands-ever/ https://arstechnica.com/information-technology/2022/03/cyber...
    - toyg 5y ago
      That's either extremely naive, or just a diversion while they go about something else.
punk_ihaq 5y ago
> Like somebody already mentioned they are similar to LulzSec in a way they are partially financially motivated LulzSec members weren't financial motivated IIRC.
- mrkramer 5y ago
  I knew somebody would bring this up; I mentioned financial motivation because these guys in particular are merging the line between financial motivation, hacktivism and bragging about their hacks. On the other hand I know LulzSec wasn't financially motivated but some individual members of LulzSec were involved in criminal activities motivated by profit in their past hacking "careers". LulzSec was all about mocking computer/internet security, bragging about their hacks and making fun about it, all wrapped up in some sort of hacktivism.

ianhawes 5y ago

I guarantee this is a group of less than 8, most of whom are under 23 and grew up in middle-class Brazilian families and have had access to computers (unfiltered and unmoderated) since age 10.

smilespray 5y ago
That's interestingly specific...
- notuger 5y ago
  the telegram channel name is related to a big hack activity in brazil last year, they always share brazilian news..
  - chockchocschoir 5y ago
    It's also a relatively easy, cheap and common opsec strategy to mask your geographic location by constantly sharing news from a place you're not actually located at. Same as saying "good morning" every day to your "team" when actually it's night at your location.
    - toyg 5y ago
      TFA said they started by targeting South American organisations, it tallies that they could be Brazilian.
    - michaelcampbell 5y ago
      I read years ago that the US "SEAL Team 6" was named to throw off adversaries (primarily Russia at the time; maybe again now?) that the US actually HAD at least 6 SEAL teams.
  - bgroat 5y ago
    This is reminding me of L in Death Note describing how he tracked Kira down to a particular Japanese neighborhood
- mrkramer 5y ago
  "Lapsus$ emerged just a few months ago, at first focused almost exclusively on Portuguese-language targets. In December and January, the group hacked and attempted to extort Brazil’s health ministry, the Portuguese media giant Impresa, the South American telecoms Claro and Embratel, and Brazilian car rental company Localiza, among others. In some cases, Lapsus$ also mounted denial-of-service attacks against victims, making their sites and services unavailable for a period of time[0]." [0] https://archive.ph/20220322060734/https://www.wired.com/story/lapsus-hacking-group-extortion-nvidia-samsung/ https://archive.ph/20220322060734/https://www.wired.com/stor...

toyg 5y ago

Microsoft: "these are bad guys motivated by theft and destruction, practicing extortion as a business model" HN: "These are kids doing it for the lulz" I'm hardly a MS supporter, but the facts seem to be on MS side here. The minute you pay somebody to gather access and then proceed to blackmail the organisation, you are organized crime. Just because they brag about it, it doesn't mean they're in it for the fun; they just think they are untouchable because they're outside US territory. It is somewhat sad that this can even be considered "hacktivism" these days. Extortion has nothing to do with activism.

andybak 5y ago
> partially financially motivated, partially hacktivist and partially bragging around Didn't you slightly oversimplify there?
- mrkramer 5y ago
  They are impossible to decipher because their demands are changing[0]. Their extortion of Nvidia: "Remove a feature known as LHR, short for "Lite Hash Rate," or see the further leaking of stolen data." "We decided to help mining and gaming community," Lapsus$ members wrote in broken English. "We want nvidia to push an update for all 30 series firmware that remove every lhr limitations otherwise we will leak hw folder. If they remove the lhr we will forget about hw folder (it's a big folder). We both know lhr impact mining and gaming." "Lapsus$ modified its demand. Now, the group also wants Nvidia to commit to making its GPU drivers completely open source. If Nvidia does not comply, Lapsus$ says, the company can expect to see a new leak that would include the complete silicon, graphics, and computer chipset files for all its recent GPUs." [0] https://arstechnica.com/information-technology/2022/03/cybercriminals-who-breached-nvidia-issue-one-of-the-most-unusual-demands-ever/ https://arstechnica.com/information-technology/2022/03/cyber...
  - toyg 5y ago
    That's either extremely naive, or just a diversion while they go about something else.

punk_ihaq 5y ago

> Like somebody already mentioned they are similar to LulzSec in a way they are partially financially motivated LulzSec members weren't financial motivated IIRC.

mrkramer 5y ago
I knew somebody would bring this up; I mentioned financial motivation because these guys in particular are merging the line between financial motivation, hacktivism and bragging about their hacks. On the other hand I know LulzSec wasn't financially motivated but some individual members of LulzSec were involved in criminal activities motivated by profit in their past hacking "careers". LulzSec was all about mocking computer/internet security, bragging about their hacks and making fun about it, all wrapped up in some sort of hacktivism.