Cyber attack

Leaked forensic details of Okta breach reveal finer details of Lapsus$ operation

Poor OPSEC and publicly available hacking tools allowed the hackers to pull off one of the most high-profile cyber attacks of the year so far
Image: Getty via Dennis

29 March 2022

Elements of cyber security company Mandiant’s report into the Sitel breach that led to the compromise of identity platform Okta earlier in March has been leaked online, revealing the finer details of Lapsus$’ operation.

Sitel retained Mandiant shortly after discovering the breach and a timeline of events was illustrated by a collection of logs included in Mandiant’s report. The timeline showed Lapsus$ downloading hacking tools straight from the Web and other revelations like Sitel seemingly storing domain passwords in an Excel spreadsheet.

Analysis by independent security researcher Bill Demirkapi suggested this spreadsheet may have allowed Lapsus$ to create a backdoor in Sitel’s environment.




Lapsus$ used publicly available tools downloaded from GitHub to facilitate its attack, Mandiant’s report indicated, including Mimikatz – a popular tool for harvesting credentials on Windows machines.

The first recorded remote desktop protocol (RDP) connection using the affected third party support engineer’s account was made on the 19 January, indicating this is when Lapsus$ first gained access to Sitel.

Lapsus$ was able to simply download Mimikatz, which has been used in high-profile cyber attacks such as NotPetya, simply from its official GitHub page and run it after disabling FireEye’s endpoint protection.

Mimikatz was used in Lapsus$ initial reconnaissance phase of the attack and the credentials harvested using the tool allowed the group to establish a foothold and escalate its privileges in Sitel’s network.

Mandiant’s report also indicated that Lapus$ concluded its objective by setting e-mail transport rules to forward all incoming and outgoing e-mail in Sitel’s environment, an observation previously highlighted by Microsoft.

Demirkapi was subsequently released from his offensive security position at Zoom for publishing the intrusion timeline from Mandiant’s report, sparking outcry in the cyber security community.

Lapsus$ is the hacking group that was behind major breaches of high-profile companies including Nvidia, Samsung, Microsoft, and LG.

Shortly after Lapsus$ announced its breach of Sitel and Okta via its Telegram channel on 22 March, UK law enforcement made a number of arrests in connection with the breach.

Seven individuals aged between 16 and 21 years were arrested on 24 March. All were released but investigations are ongoing.

© Dennis Publishing

Read More:

Comments are closed.

Back to Top ↑