LAPSUS$ was run by a bunch of teenagers apparently and its most active members are now behind the bars. Krebs on Security obtained a week’s worth of private chats between key LAPSUS$ members, which gives a glimpse into their modus operandi.
They relentlessly targeted T-Mobile employees and were able to breach the carrier’s system multiple times last month, giving them access to source code for a range of projects. The rogue group briefly considered SIM swaps, which would have let them hijack someone else’s number, which could have allowed them to conduct activities like password resets.
LAPSUS$ gained access to the internal customer accounts management tool Atlas on March 19 and explored high-profile T-Mobile accounts associated with the FBI and Department of Defense. They weren’t able to go any further than that because those accounts required additional verifications before any changes could be made.
He was also able to download over 30,000 source code repositories from T-Mobile. It looks like this is when their access was revoked, as, in the words of White, “Cloning 30k repos four times in 24 hours isn’t very normal.”
LAPSUS$ may had intended to target high-profile T-Mobile accounts
T-Mobile has confirmed the attacks but has assured that the hackers weren’t able to steal any customer or government information.
Several weeks ago, our monitoring tools detected a bad actor using stolen credentials to access internal systems that house operational tools software. The systems accessed contained no customer or government information or other similarly sensitive information, and we have no evidence that the intruder was able to obtain anything of value. Our systems and processes worked as designed, the intrusion was rapidly shut down and closed off, and the compromised credentials used were rendered obsolete.
For all the latest Technology News Click Here
For the latest news and updates, follow us on Google News.
