Advanced Persistent Teenagers: Understanding the Lapsus$ Playbook

Advanced Persistent Teenagers: Understanding the Lapsus$ Playbook

Speakers: Benjamin Hering

Conference: BSidesSF 2024

YouTube: https://www.youtube.com/watch?v=9wpBaXcXQSM

Overview

This talk, "Advanced Persistent Teenagers: Understanding the Lapsus$ Playbook," delivered by Benjamin Hering, delves into the tactics, techniques, and procedures (TTPs) employed by the notorious Lapsus$ hacking group. Hering, who works for Saildrone, a company specializing in uncrewed marine vessels, uses the analogy of aviation safety's evolution to highlight the critical need for understanding root causes in cybersecurity incidents. The presentation is largely based on the Cyber Safety Review Board (CSRB) report, a comprehensive analysis of Lapsus$'s activities.

The core message of the talk is that Lapsus$, despite being a group of 8-10 individuals, primarily teenagers, operating without nation-state backing, multi-million dollar budgets, or a stockpile of zero-day exploits, managed to breach numerous high-profile organizations. Their success stemmed from a consistent "playbook" that heavily leveraged social engineering, multi-factor authentication (MFA) bypasses, and exploitation of fundamental security hygiene gaps. The talk emphasizes that while the Lapsus$ moniker may no longer be active, their methods persist, making it crucial for the cybersecurity community to learn from their attacks.

Hering's presentation serves as a vital resource for defenders, offering actionable insights derived from real-world incidents. By dissecting the Lapsus$ playbook through several case studies, including Uber, Okta (via Sitel), Cisco, Rockstar Games, and MGM Resorts, the talk aims to equip organizations with the knowledge to bolster their defenses against similar, low-cost but highly effective, threat actors. It underscores that the most effective countermeasures often involve "eating your vegetables"—mastering basic security hygiene rather than relying on expensive, complex solutions.

Background

▶ Watch: Introduction to the Cyber Safety Review Board (CSRB) and its purpose (01:00)

The genesis of the Cyber Safety Review Board (CSRB), whose report forms the backbone of this presentation, draws a parallel to the early, "incredibly bloody" history of aviation. Just as the frequent crashes of early aircraft led to the establishment of the National Transportation Safety Board (NTSB) to investigate root causes and inform regulations, a similar need arose in cybersecurity. After decades of significant cyber incidents, the CSRB was formed as a hybrid body, comprising both government personnel and "real-world practitioners" like Heather Atkins (Google), Katie Moussouris (early adopter of bug bounties at Microsoft and DoD), and Wendy Nather (Unit 42, Palo Alto Networks). Their mandate is to study major cyber incidents to understand "exactly what went wrong."

The CSRB's report on Lapsus$ revealed a threat actor group distinct from typical nation-state or highly resourced criminal organizations. Lapsus$ consisted of approximately 8 to 10 known members, primarily operating out of Brazil and the UK. Crucially, they had "no nation-state affiliation," "no million-dollar budgets," and "no stockpile of zero days." Their motivations were dual: financial gain through extortion, data sales, and ransomware, but also a clear enjoyment of "breaking into companies with multi-million dollar security budgets and then, you know, laughing at them from the public internet." While the Lapsus$ name itself is no longer actively used, the "Playbook keeps continuing on," making the study of their methods perpetually relevant.

The problem Lapsus$ exploited was not a lack of advanced security technology in their targets, but rather a pervasive weakness in human factors and basic security controls. Their success highlighted that even organizations with substantial security investments could be compromised by persistent social engineering and a failure to implement fundamental, fishing-resistant authentication mechanisms. The talk emphasizes that the lessons learned from Lapsus$ are not about critiquing the "very smart security engineers" who had "really, really bad days," but rather about learning from the details they were willing to share, unlike many other victim organizations that kept their incidents private.

Key Findings

▶ Watch: Lapsus$ initial access methods: social engineering (phone phishing, MFA spamm... (04:00)

The Lapsus$ playbook, as detailed by Benjamin Hering, reveals several critical findings about their modus operandi and the vulnerabilities they exploited:

• Social Engineering as the Primary Initial Access Vector: Lapsus$ consistently relied on "people hacking" rather than "computer hacking" for initial access. This involved extensive reconnaissance on LinkedIn to identify employees, followed by targeted phone phishing of help desks (impersonating employees) or employees (impersonating help desk), and SMS phishing.
• Ubiquitous MFA Bypass: Despite the widespread adoption of multi-factor authentication, Lapsus$ routinely bypassed common MFA methods. They extensively used Man-in-the-Middle (MitM) attack proxies like Evilginx to intercept credentials and one-time passwords, rendering time-based one-time passwords (TOTP) and SMS/push notifications ineffective unless the MFA was explicitly fishing-resistant (e.g., security keys, passkeys). MFA fatigue, where users are spammed with push notifications until they accept, was also a highly effective tactic.
• Exploitation of Human and Organizational Trust: Lapsus$ exploited human vulnerabilities through tactics like SIM swaps (sometimes paying up to $2,000 a week) and directly paying employees at target companies for valid credentials. They also purchased credentials from underground marketplaces like Starbot.
• Privilege Escalation through Basic Misconfigurations and Data Exposure: Once initial access was gained, Lapsus$ would "land and expand." This often involved scanning internal networks for open shares, finding "password.xls" files, discovering AWS keys in Slack, or even following new user onboarding guides to gain access to source code and other sensitive resources. The discovery of "emergency break-glass credentials" in a PowerShell script on an open SMB share (Uber case study) exemplifies this.
• Supply Chain Attacks via Business Process Outsourcers (BPOs): Lapsus$ extensively exploited the trust relationships between organizations and their BPOs. The Okta/Sitel Group incident highlighted how compromising a third-party support desk vendor could be a stepping stone to a larger target, even if the ultimate impact was limited due to the target's robust security hygiene.
• Abuse of Emergency Disclosure Requests (EDRs): The CSRB report noted that Lapsus$ leveraged fraudulent EDRs, typically used by law enforcement for urgent data requests, to gain access to personal accounts and sensitive information. This tactic put companies in a bind, forcing quick decisions under pressure.
• Low Cost of Operation: The Rockstar Games case study revealed that the tools used by a key Lapsus$ member (White) were remarkably simple and inexpensive: an Amazon Fire TV stick, a Bluetooth keyboard, and a cheap mobile phone. This demonstrates that sophisticated attacks do not require sophisticated tools, but rather ingenuity and persistence.
• The Playbook Endures: Even though the Lapsus$ group itself may have dissolved or rebranded, their "playbook" continues to be used by other threat actors. The MGM Resorts incident, attributed to a different ransomware group, exhibited initial access tactics strikingly similar to Lapsus$'s, reinforcing the idea that these methods are widely adopted.
• Basic Cyber Hygiene is Paramount: Repeatedly, the CSRB and Hering emphasized that the most effective defenses against Lapsus$ were not "shiny blinky boxes" or advanced AI solutions, but rather fundamental security practices: robust, fishing-resistant MFA, diligent patching, and well-defined incident response processes.

Technical Deep Dive

▶ Watch: Okta/Sitel case study: supply chain attack via BPO, limited impact due to lea... (09:30)

Lapsus$'s success was rooted in a methodical approach that combined social engineering with technical exploitation, often targeting the weakest links in an organization's security chain.

Initial Access Techniques:

1. Social Engineering (People Hacking):

• LinkedIn Reconnaissance: Lapsus$ would begin by identifying employees of target companies on LinkedIn, gathering personal details to craft convincing pretexts.
• Phone Phishing Help Desks: They frequently called internal help desks, impersonating legitimate employees to request password resets or MFA enrollments.
• Phone Phishing Employees: Conversely, they would impersonate IT support or help desk personnel to trick employees into divulging credentials or accepting MFA prompts.
• Targeted SMS Phishing: Sending malicious links or requests via SMS to employees.

1. MFA Bypass Mechanisms:

• Man-in-the-Middle (MitM) Proxies: Tools like Evilginx were extensively used. These proxies sit between the user and the legitimate login page, capturing credentials and session cookies, including those generated after a successful MFA challenge. This technique effectively bypasses TOTP, SMS, and push-based MFA unless the MFA solution is explicitly fishing-resistant, such as security keys or passkeys (based on FIDO/WebAuthn standards).
• MFA Fatigue: A surprisingly effective tactic involved repeatedly sending MFA push notifications to a target user. The hope was that the user, annoyed or confused, would eventually accept a prompt, granting the attacker access. As Hering noted, "you can basically annoy people into hitting yes."
• SIM Swaps: By convincing a mobile carrier to transfer a target's phone number to an attacker-controlled SIM card, Lapsus$ could intercept SMS-based MFA codes. This was sometimes achieved by paying individuals up to "$2,000 a week."
• Insider Threats/Credential Purchase: Lapsus$ would directly pay employees for valid credentials or purchase them from underground marketplaces like Starbot. The Uber case study highlighted this, where "Uber passwords" were available for $10-$20 on such marketplaces.

1. Vulnerability Exploitation:

• Public-Facing Vulnerabilities: Lapsus$ scanned the internet using tools like Shodan or Safari for unpatched "border devices" susceptible to "CVSs 10 out of 10 remote code execution" vulnerabilities. While specific CVEs weren't named, the talk indicated "these two CVEs in particular were favorites of Lapsus$." The Cisco incident, for example, involved the compromise of "a series of Citrix servers," which often have publicly known vulnerabilities.

1. Supply Chain Exploitation:

• Business Process Outsourcers (BPOs): Lapsus$ extensively targeted BPOs, recognizing them as trusted third parties with access to client systems. The Okta/Sitel Group incident demonstrated this, where Sitel, an outsourced support desk, was compromised to potentially gain access to Okta's customers.

1. Emergency Disclosure Request (EDR) Abuse:

• The CSRB report noted that Lapsus$ leveraged fraudulent EDRs, typically used by law enforcement, to gain access to personal accounts. Researchers found "at least 112 domains" used for EDR abuse, including those mimicking legitimate international law enforcement agencies. This tactic was speculated to be the initial compromise vector for a Cisco employee's personal Google account.

Privilege Escalation and Lateral Movement:

Once initial access was established, Lapsus$ employed standard "land and expand" techniques:

• Internal Network Scanning: After gaining VPN access (e.g., Uber), they would scan the internal network for vulnerable systems or exposed resources.
• Credential Discovery:
• Open SMB Shares: The Uber incident revealed a critical flaw: an open SMB share containing a PowerShell script with "emergency break-glass credentials" for Uber's security team's password manager. This provided administrative access to the "Keys of the Kingdom."
• Plaintext Files: Searching for "password.xls" files or other documents containing credentials.
• Developer Resources: Finding AWS keys in Slack channels or following new user onboarding guides to gain access to source code repositories.
• Domain Controller Compromise: In the Cisco case, after compromising Citrix servers, Lapsus$ obtained "privilege access to domain controllers" and then "dumped and exfilled the NTLM directory services to extract credentials."

Exfiltration and Extortion:

• Data Exfiltration: Lapsus$ would exfiltrate sensitive data, often for extortion purposes. In the Cisco incident, they exfiltrated the contents of the initial employee's Box.com account (which contained no sensitive data) and the Active Directory authentication data.
• Extortion: The Rockstar Games incident saw Lapsus$ exfiltrate "90 videos of unreleased GTA 6" and then post an extortion message on Rockstar's internal Slack, threatening to release source code if not contacted within 24 hours.

The simplicity of the tools used by Lapsus$ – an Amazon Fire TV stick, a Bluetooth keyboard, and a cheap mobile phone – underscores that their effectiveness came from understanding human psychology and exploiting common security weaknesses, rather than relying on advanced technical prowess.

Demo / Proof of Concept

▶ Watch: Cisco case study: personal Google account compromise, password sync, help des... (11:30)

The presentation "Advanced Persistent Teenagers: Understanding the Lapsus$ Playbook" is a detailed analysis of past incidents and a review of the Lapsus$ group's tactics, techniques, and procedures. It does not include a live demonstration or a proof of concept of any of the attack methods discussed. Instead, Benjamin Hering relies on case studies and the findings of the Cyber Safety Review Board report to illustrate how Lapsus$ operated and how their attacks unfolded in real-world scenarios.

Defensive Implications

▶ Watch: Defense strategies: fishing-resistant MFA (security keys, passkeys), financia... (20:00)

Understanding the Lapsus$ playbook provides clear, actionable defensive strategies for organizations. Benjamin Hering outlines several key areas where defenders should focus their efforts:

1. Authentication: Embrace Fishing-Resistant MFA

• Mandate Security Keys and Passkeys: The most critical recommendation is to move beyond traditional MFA methods like SMS, TOTP, and push notifications. These are easily defeated by MitM proxies like Evilginx and susceptible to MFA fatigue. Fishing-resistant MFA, such as security keys (e.g., YubiKeys, based on FIDO U2F/WebAuthn standards) and passkeys, is the only reliable defense against targeted phishing. These methods prevent attackers from intercepting credentials or spamming users into submission.
• Eliminate MFA Fatigue: Fishing-resistant factors inherently prevent MFA fatigue because there's no "push" to accept; the authentication event requires a physical interaction with a trusted device.
• Authenticate Key Business Transactions: For critical actions that might typically be handled over a phone call (e.g., password resets, account changes), implement a technical solution that requires an authenticated event. This transforms a social engineering vulnerability into a technically protected process.

1. Business Process Outsourcers (BPOs): Secure the Supply Chain

• Align Financial Incentives: BPOs are often incentivized for speed and customer satisfaction, not security. Contracts should include concrete security outcomes or processes that, if not met, result in financial penalties. This creates "financial skin in the game" and aligns their security posture with the client's.
• Implement Least Privilege: As demonstrated by Okta's response to the Sitel incident, provisioning BPO access with least privilege is crucial. Even if a BPO workstation is compromised, the attacker's lateral movement and impact can be severely limited.
• Provide Company-Owned Devices: If a help desk person wouldn't reset an admin password from their personal computer, a BPO employee shouldn't either. Provide BPO staff with company-owned laptops pre-configured with security agents for visibility and enforce the same cybersecurity processes as internal employees.
• Consider Bringing Functions In-House: In the aftermath of Lapsus$ attacks, many companies opted to bring critical outsourced functions back in-house to regain direct control over security.

1. Telephony: Don't Treat Telecom as an Identity Provider

• Understand Telecom's Priority: Telecom providers prioritize availability (e.g., 911 calls connecting every time) over being a robust identity provider. Relying on them for identity verification (e.g., SMS MFA, phone-based support) significantly expands the attack surface to include SIM swaps, insider threats at the telecom company, and even vulnerabilities at "an unattended kiosk at the Verizon store."
• Decouple Identity from Telephony: Organizations should avoid making their telecom provider their primary identity provider.

1. Basic Cyber Security Hygiene: "Eat Your Vegetables"

• Focus on Fundamentals: The CSRB consistently found that the most effective defenses against Lapsus$ were not "shiny blinky boxes" or expensive AI solutions, but rather "doing the fundamental s and doing them well." This includes:
• Comprehensive MFA Coverage: Ensuring all accounts and systems are protected by MFA.
• Diligent Patching: Promptly applying patches for known vulnerabilities, especially on internet-facing systems (e.g., Citrix servers).
• Robust Triage and Incident Response: Having a clear process for triaging security findings and dedicating resources to address them.
• Prioritize the Basics: These "hard" but fundamental practices yield the best security outcomes.

1. Deception: "Lying is Good Actually"

• Deploy Canary Tokens: Since attackers like Lapsus$ search for credentials (e.g., "password.xls" files, AWS keys in Slack), organizations can deploy canary tokens (e.g., from Canarytokens.org). These are fake credentials or files that, when accessed, trigger an alert.
• Targeted and Logged Deployment: Tokens should be placed "precise and targeted," surrounded by logging to provide visibility into who accessed them and when. This helps identify compromised accounts or lateral movement attempts.

1. Community and Intervention: Redirect Talent

• Address Root Causes of Cybercrime: The CSRB noted the "lost opportunity" to redirect the "brilliant" teenagers of Lapsus$ from cybercrime to defensive roles.
• Foster an Inclusive Community: Hering encourages the security community to be intentional about creating a welcoming space, inviting "the noob," and adhering to codes of conduct that prohibit harassment and marginalization. Building a strong, inclusive community can help attract and retain talent, potentially steering individuals away from malicious activities.

Key Takeaways

• Fishing-resistant MFA is paramount: Traditional MFA (SMS, TOTP, push notifications) is vulnerable to MitM attacks and MFA fatigue. Organizations must adopt security keys and passkeys (FIDO/WebAuthn standards) to effectively defend against targeted social engineering.
• Social engineering remains a primary threat vector: Lapsus$'s success highlights that "people hacking" through LinkedIn reconnaissance, phone phishing, and SMS phishing is highly effective, even against organizations with large security budgets.
• Supply chain security, especially BPOs, is critical: Outsourced vendors represent a significant attack surface. Organizations must enforce strong contractual security requirements, implement least privilege, and consider providing company-owned devices to BPO staff.
• Basic cyber hygiene is the most effective defense: Diligent patching, comprehensive MFA coverage, and robust incident response processes are more impactful than expensive, advanced security tools. "Eating your vegetables" provides the best security outcomes.
• Deception techniques can enhance detection: Deploying canary tokens (e.g., fake password files, AWS keys) with proper logging can provide early alerts to unauthorized access and lateral movement within the network.
• Telecom providers are not identity providers: Relying on telecom for identity verification introduces significant risks, including SIM swaps and insider threats, due to their primary focus on availability rather than robust identity security.

About the Speaker(s)

Benjamin Hering is a cybersecurity professional who delivered the talk "Advanced Persistent Teenagers: Understanding the Lapsus$ Playbook" at BSidesSF 2024. He works for Saildrone, a company that manufactures uncrewed marine vessels equipped with various sensors. These vessels are primarily powered by wind and solar, enabling them to perform unique tasks such as being deployed into the middle of hurricanes to collect data. This data assists organizations like NOAA (National Oceanic and Atmospheric Administration) in generating more accurate forecasts for hurricane landfalls and other meteorological events. Hering explicitly stated that his work at Saildrone, while interesting, was unrelated to the content of his talk, which focused entirely on cybersecurity. He made his slides and speaker notes available under a Creative Commons non-commercial license, encouraging others to use and share the information for educational purposes. He can be reached via the BSidesSF Slack channel or email.