Lapsus$: no zero-days, just people
The group that hit Nvidia, Samsung, Microsoft and Okta used MFA spam, SIM swaps and paid insiders. Defend those.
In a few months, a young group called Lapsus$ got into Nvidia, Samsung, Microsoft and, last week, a support contractor working for Okta. Microsoft’s write-up of their methods is worth reading because there’s nothing exotic in it:
- Buying passwords and session tokens from infostealer markets.
- Spamming MFA prompts until someone approves.
- SIM swapping to take over phone numbers used for codes.
- Openly offering to pay employees for access.
- Then joining the company’s own chat and calls to watch the response.
The defences match:
- Phishing-resistant MFA such as security keys for admins and support staff. No prompts to spam, no codes to steal.
- Move away from SMS codes.
- Strong checks for help desk resets and new MFA devices.
- Treat contractors’ access like your own staff’s: same MFA, same logging, least access.
- Run incident calls on a separate channel when you suspect your main one is watched.
And tell your staff that anyone offering money for access should be reported. It sounds obvious. It worked for Lapsus$.