Security News > 2022 > March > Microsoft warns of destructive attacks by Lapsus$ cybercrime group
Microsoft warns of destructive attacks by Lapsus$ cybercrime group.
In a blog post published Tuesday, Microsoft provides insight into the group's tactics and techniques and offers tips on how to protect your organization from these attacks.
By compromising the servers hosting these tools, the group tries to obtain the credentials of a privileged account and then uses a built-in Microsoft command known as ntdsutil to extract the Active Directory database of a targeted network.
Determining which accounts have higher privileges, the group then searches platforms such as SharePoint, Confluence, JIRA, GitLab and GitHub to find even more high-privilege account credentials through which it can access additional sensitive data.
To handle risk-based sign-in detection, your VPN authentication should take advantage of such options as OAuth or SAML connected to Azure AD. This type of VPN authentication has proven effective against attacks by Lapsus$, according to Microsoft.
Also See Share: Microsoft warns of destructive attacks by Lapsus$ cybercrime group.
News URL
https://www.techrepublic.com/article/microsoft-warns-destructive-attacks-lapsus-cybercrime-group/
Related news
- Microsoft still unsure how hackers stole MSA key in 2023 Exchange attack (source)
- Microsoft fixes two Windows zero-days exploited in malware attacks (source)
- Week in review: Palo Alto Networks firewalls under attack, Microsoft patches two exploited zero-days (source)
- New Latrodectus malware attacks use Microsoft, Cloudflare themes (source)
- Microsoft warns of "Dirty Stream" attack impacting Android apps (source)
- Microsoft fixes Windows zero-day exploited in QakBot malware attacks (source)
- Microsoft fixes a bug abused in QakBot attacks plus a second under exploit (source)
- Cybercriminals Exploiting Microsoft’s Quick Assist Feature in Ransomware Attacks (source)