Advanced Persistent Teenagers: Understanding the Lapsus$ Playbook
summary
Eight to ten teenagers using low‑cost tools and social engineering breach Microsoft, Okta, Uber and more without zero‑days, buying credentials for $10–$20, spamming MFA until victims accept (MFA fatigue), using SIM swaps and help‑desk impersonation, and running man‑in‑the‑middle proxies like evilginx to defeat tokens. Results include ~1 PB of Uber admin data screenshots, exfiltrated Active Directory creds at Cisco, GTA VI leaks that cost Rockstar ~$5M and 90 videos, and a 10‑day MGM outage. Defenses that work are phishing‑resistant MFA, tighter BPO contracts, corporate‑owned helpdesk devices and canary tokens.
AI-written summary · about
chapters (10)
- 0:00Introduction to Lapsus$
- 1:06The Lapsus$ playbook
- 4:17Initial access strategies
- 5:58Case studies: Uber and Okta
- 10:42Abuse of disclosure requests
- 12:42Cisco and Rockstar incidents
- 17:22MGM Resorts and disclosures
- 19:50Defensive security strategies
- 24:01Community and closing remarks
- 27:20Q&A session
related talks
40mModern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
38mAnatomy of the Attack: The Rise and Fall of MFA
59m50 Shades of AppSec
31mLog In Through the Front Door: Automating Defense Against...
32mFriend or Replicant: How Attackers Automate and Disguise Themselves
44mThe Unpatchables: Credential Stuffing Quantification and Classification
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up