Security News > 2022 > March > Microsoft warns of destructive attacks by Lapsus$ cybercrime group
Microsoft warns of destructive attacks by Lapsus$ cybercrime group.
In a blog post published Tuesday, Microsoft provides insight into the group's tactics and techniques and offers tips on how to protect your organization from these attacks.
By compromising the servers hosting these tools, the group tries to obtain the credentials of a privileged account and then uses a built-in Microsoft command known as ntdsutil to extract the Active Directory database of a targeted network.
Determining which accounts have higher privileges, the group then searches platforms such as SharePoint, Confluence, JIRA, GitLab and GitHub to find even more high-privilege account credentials through which it can access additional sensitive data.
To handle risk-based sign-in detection, your VPN authentication should take advantage of such options as OAuth or SAML connected to Azure AD. This type of VPN authentication has proven effective against attacks by Lapsus$, according to Microsoft.
Also See Share: Microsoft warns of destructive attacks by Lapsus$ cybercrime group.
News URL
https://www.techrepublic.com/article/microsoft-warns-destructive-attacks-lapsus-cybercrime-group/
Related news
- VEILDrive Attack Exploits Microsoft Services to Evade Detection and Distribute Malware (source)
- Microsoft patches Windows zero-day exploited in attacks on Ukraine (source)
- Microsoft, Meta, and DOJ Disrupt Global Cybercrime and Fraudulent Networks (source)
- Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks (source)
- Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks (source)
- Microsoft enforces defenses preventing NTLM relay attacks (source)
- Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks (source)