The extortion gang known as LAPSUS$ has recently made the news once again for brazenly targeting both Microsoft and Okta. The threat posed by extortion gangs such as LAPSUS$ will likely remain relevant for the foreseeable future, whether or not their current activity streak continues.
At Wiz Research, we focus on finding the effective measures to defend against threats presenting the most critical risks to cloud customers, so rather than summarize this threat actor’s history or further discuss their recent high-profile activity, this blogpost will focus on the following:
The threats posed by actors such as LAPSUS$ to cloud environments.
Practical steps cloud customers should take to improve their defenses against these threats.
According to Microsoft’s recent report on LAPSUS$ (tracked by Microsoft as DEV-0537), this actor has infiltrated the cloud tenants of their victims and has proven capable of navigating cloud environments, escalating privileges, and achieving lateral movement between cloud resources and on-premises machines.
LAPSUS$ is evidently a dynamic and flexible threat actor, using a wide range of tactics. Therefore, the utility of scanning for IOCs related to their tooling or infrastructure will undoubtedly be short-lived. Furthermore, we should assume that LAPSUS$ and other threat actors are closely following public reporting about their activity and will probably adapt their tradecraft to overcome brittle or overly specific mitigation efforts.
All the recommendations listed here are considered industry best practices. Still, we have prioritized courses of action best suited to minimize the risks associated with this type of malicious activity – primarily credential compromise and data exfiltration.
Additionally, specific guidance is included for Wiz customers to help ensure their environments are protected.
For further security guidance related to this malicious activity and more specific instructions for hardening Azure environments, see the recommendations outlined in Microsoft’s report on DEV-0537.
Characterizing the threat to cloud environments
Generally speaking, we can identify three stages of the attack flow adopted by the LAPSUS$ group:
Gaining initial access through compromised users – First, the attackers obtain initial access to the target systems by impersonating user accounts via stolen credentials or by infiltrating publicly exposed resources through insecure authentication. Therefore, the effective attack surface at this stage is composed primarily of externally accessible user accounts (the more privileged the better, as far as the attacker is concerned).
Abusing access to exploit unpatched applications and gather exposed secrets – Once the attackers gain access to a target account, they set out to abuse the permissions of whatever user accounts, resources and service accounts are accessible to them. To this end, they search for secrets exposed on internal resources, and attempt to exploit vulnerable internal systems and applications – which weren’t at risk in the first stage – for the purpose of escalating their privileges in the target cloud infrastructure environment.
Gaining access to internal cloud infrastructure resources – The attackers then pivot on newly gained permissions in order to expand their scope of access and control within the cloud environment, until they reach resources containing valuable assets such as code or sensitive information that can be used for extortion.
We can therefore conclude that LAPSUS$ and “LAPSUS$-like” attackers would be impeded by effective patch and secret management, minimal permissions, secure authentication, as well as security-by-design – for example, partitioning business, development and production environments would limit their potential reach even if they successfully compromised a user account. In the next section, we shall derive practical defensive measures from these observations.
Actionable steps to harden your cloud environment
#1 - Enforce MFA and require MFA for accessing sensitive resources
Although multi-factor authentication is not bulletproof, and threat actors such as LAPSUS$ have discovered ways to bypass it under certain circumstances, it remains an effective and proven defensive mechanism against account compromise. CISA, Google, and Microsoft highly recommend it.
Recommended actions
Enforce multi-factor authentication across your entire organization, particularly for highly privileged accounts.
Additionally, you should define policies explicitly allowing only users with MFA enabled to access resources containing sensitive data (for example, in AWS, supplement the relevant resource policies with a condition statement requiring MultiFactorAuthPresent).
#2 - Revoke unnecessary permissions
LAPSUS$ have been known to compromise highly privileged user accounts as an initial access vector to their target networks, using them to access resources in the environment. According to Microsoft, when gaining access to cloud environments, LAPSUS$ has also abused their permissions to create new resources supporting their operation.
However, global administrative permission would be the most valuable asset this actor could hope to get their hands on while maneuvering in cloud environments. According to Microsoft, LAPSUS$ has previously gained and used global admin status to lock out other administrators from the breached cloud environment.
Recommended actions
Global admin permissions should be limited to specific dedicated service accounts (such as IAM roles), with trust policies explicitly permitting only specific highly trusted users to assume them. Moreover, you should review all highly privileged users and service accounts to ensure that they absolutely require all their permissions, and revoke any unnecessary permissions, thus adhering to the principle of least privilege. Finally, you should also take this opportunity to identify any suspicious newly created users or roles.
#3 - Purge exposed secrets
As mentioned above, LAPSUS$ has relied on compromising user accounts as an initial access vector. They have sourced stolen credentials from underground forums, publicly exposed secrets (such as keys in public code repositories), and supposedly bribed insiders.
Once LAPSUS$ breaches their target network, they search for additional credentials in the local environment.
Recommended actions
Cloud customers should ensure that their secrets – such as API keys, encryption keys and tokens – are strictly managed (via a key management system such as Azure Key Vault), rotated often, and are not stored in cleartext on any publicly exposed resources.
#4 - Safeguard VMs from risky authentication methods
Besides stealing credentials that allow them to impersonate cloud users and service accounts, actors such as LAPSUS$ could collect leaked passwords and use them to connect via SSH or RDP to publicly exposed virtual machines in cloud environments. This risk surfaces when overly permissive ACL or firewall rules allow SSH or RDP connections to a VM from any IP address, and local users happen to use weak, re-used or empty passwords. However, this is most dangerous when allowing these types of authentication to the local root user of the VM.
Recommended actions
Ensure that local users on VMs allowing SSH or RDP authentication have strong passwords, or preferably use keys instead. The local root user should never use a password for SSH authentication. Additionally, configure ACL or firewall rules to prevent SSH and RDP connections from unknown IP ranges, and ideally require MFA for these connections as well.
#5 - Patch sensitive systems and known targeted software
According to Microsoft, LAPSUS$ has exploited vulnerabilities in Jira, Gitlab, and Confluence servers.
Recommended actions
While actors like LAPSUS$ will certainly not limit their exploitation to these specific products, customers using them should prioritize locating and patching all vulnerable unpatched instances of these technologies in their environment, both publicly exposed and internal (as a malicious actor with access to your environment could just as easily exploit internal servers). Moreover, you should give precedence to patching systems containing sensitive information, as well as those with critical known exploited vulnerabilities.
#6 - Detect known malware
According to Microsoft, LAPSUS$ has deployed the Redline password stealer in target networks. Presumably, this actor utilizes additional offensive security tooling and off-the-shelf malware.
Recommended actions
Ensure your endpoints are protected against malware in general (whether you use cloud-native agentless solutions or rely on traditional agent-based solutions).
Protecting your cloud environment with Wiz
Wiz allows you to easily identify deviations from the recommendations outlined in this blogpost across all your cloud environment layers; insecure configuration, workload vulnerabilities, cloud entitlements, effective network exposure and more.
Wiz customers can use the following steps to reduce the risk posed by LAPSUS$-like threat actors:
Enforce MFA and require MFA for accessing sensitive resources – Wiz alerts you to highly privileged users without MFA enabled (or you can see all users without MFA enabled). Additionally, you can view all resources in your environment allowing access without requiring MFA.
Revoke unnecessary permissions – Wiz allows you to review all administrative service accounts and overly permissive policies in your environment, making it easier to decide which permissions can be revoked without losing functionality. Wiz also alerts you to critical issues such as highly privileged service accounts that can be assumed by anyone.
Purge exposed secrets – Wiz brings to your attention issues relating to insecure use of secrets in your environment, such as publicly exposed VMs containing cleartext keys allowing admin privileges or cross-account access; and administrative users with keys that haven’t been rotated for over 90 days. Additionally, Wiz-CLI alerts you to secrets exposed in code in your CI/CD pipeline before they get to production.
Safeguard VMs from risky authentication methods – With Wiz, you can easily locate publicly exposed virtual machines with password authentication enabled for the local root user, particularly weak or empty passwords, as well as virtual machines allowing SSH or RDP connections from any IP address.
Patch sensitive systems and known targeted software – Wiz can alert you to cloud resources running unpatched software known to be targeted by LAPSUS$ (and presumably other threat actors as well). Moreover, Wiz users can easily find all unpatched resources in their environments, including publicly exposed virtual machines, serverless and containers with critical known exploited vulnerabilities. Wiz covers all CISA known exploited vulnerabilities, allowing you to easily identify affected resources and better prioritize patching efforts.
Detect known malware – Wiz alerts you to resources infected with malware, including Redline.
This blogpost was written by the Wiz Research Team, as part of our ongoing mission to analyze threats to the cloud, build mechanisms that prevent and detect them, and fortify cloud security strategies.
