How to Harden Cloud Environments Against LAPSUS$-Like Threats
Summary
Wiz Research outlines LAPSUS$-like attack stages and recommends cloud defenses including MFA, least privilege, secret rotation, safer SSH/RDP access, patching, and malware protection.
Key points
- The article describes a three-stage attack flow: compromised accounts or exposed resources, abuse of access to find secrets or exploit vulnerable systems, and movement into cloud resources holding valuable data.
- Require MFA across the organization, especially for privileged accounts, and for access to sensitive resources.
- Restrict global administrator privileges, review privileged users and service accounts, and remove unnecessary permissions.
- Manage and regularly rotate API keys, encryption keys, and tokens; avoid storing secrets in cleartext on publicly exposed resources.
- Secure SSH and RDP access to cloud VMs with strong credentials or keys, restrict connections by IP range, and avoid password-based SSH for local root accounts.
- Patch vulnerable and sensitive systems, including Jira, GitLab, and Confluence instances; the article says Microsoft reported LAPSUS$ exploiting vulnerabilities in those products.
- Protect endpoints against malware; Microsoft reportedly observed LAPSUS$ deploying the Redline password stealer.
Article Details
- Defense Focus
- Reduce cloud compromise risks associated with LAPSUS$-like activity, especially credential compromise and data exfiltration, through hardening, least privilege, secret management, patching, and malware detection.
- Detection Methods
- Identify users and resources that lack MFA, especially highly privileged accounts and access to sensitive resources.
- Review administrative service accounts, overly permissive policies, and highly privileged service accounts that can be assumed by anyone.
- Find publicly exposed resources containing cleartext secrets, administrative users with keys not rotated for over 90 days, and secrets in CI/CD code before production.
- Identify publicly exposed VMs with password authentication enabled for the local root user, weak or empty passwords, or SSH/RDP access allowed from any IP address.
- Locate unpatched resources running software known to be targeted by LAPSUS$, and prioritize systems with critical known exploited vulnerabilities.
- Detect resources infected with malware, including Redline.
- Data Sources
- Cloud identity and entitlement configurations, including MFA status, privileged users, service accounts, and trust policies.
- Cloud resource and network exposure configurations, including VM authentication settings and ACL or firewall rules.
- Secret stores and exposed code, including CI/CD pipelines.
- Software vulnerability and patch status across cloud resources.
- Endpoint and workload malware detections.
- Platforms
- Wiz
- Defensive Actions
- Enforce MFA organization-wide, especially for privileged accounts, and require MFA for access to sensitive resources.
- Restrict global administrator permissions to dedicated service accounts and trusted users; review privileges and remove unnecessary permissions.
- Find and investigate suspicious newly created users or roles.
- Manage and frequently rotate API keys, encryption keys, and tokens; avoid storing secrets in cleartext on publicly exposed resources.
- Use strong passwords or keys for local VM users; do not use password-based SSH authentication for the local root user.
- Restrict SSH and RDP to known IP ranges and require MFA for these connections where possible.
- Locate and patch vulnerable Jira, Gitlab, and Confluence instances, including internal systems, prioritizing systems containing sensitive information and vulnerabilities known to be exploited.
- Protect endpoints against malware and partition business, development, and production environments to limit the reach of compromised accounts.
MITRE ATT&CK
T1003 · OS Credential DumpingThe article reports that LAPSUS$ deployed the Redline password stealer in target networks.T1021 · Remote ServicesThe article describes pivoting with newly gained permissions to expand access across cloud resources and on-premises machines.T1021.001 · Remote Desktop ProtocolThe article describes using leaked passwords to connect to cloud VMs through RDP.T1021.004 · SSHThe article describes using leaked passwords to connect to cloud VMs through SSH.T1041 · Exfiltration Over C2 ChannelData exfiltration is identified as a primary risk associated with this type of malicious activity, but the article gives no specific exfiltration method.T1068 · Exploitation for Privilege EscalationThe article describes exploiting vulnerable internal systems and applications to escalate privileges in cloud environments.T1078 · Valid AccountsThe article describes LAPSUS$ gaining initial access by impersonating user accounts with stolen credentials.T1078.004 · Cloud AccountsThe article describes attackers using stolen credentials to access cloud accounts and cloud environments.T1098 · Account ManipulationThe article reports that LAPSUS$ abused permissions to create new resources and used global administrator status to lock out other administrators.T1110 · Brute ForceThe article describes actors using leaked passwords to connect to publicly exposed VMs over SSH or RDP.T1210 · Exploitation of Remote ServicesThe article describes exploiting vulnerable internal systems and applications after gaining access to a target environment.T1552.001 · Credentials In FilesThe article says LAPSUS$ searches for secrets and credentials in local environments and exposed keys in public code repositories.
Threat Actors
Malware
Vendors
MicrosoftThe extortion gang known as LAPSUS$ has recently made the news once again for brazenly targeting both Microsoft and Okta. The threat posed by extortion gangs such as LAPSUS$ will likely remain relevant for theWizAt Wiz Research, we focus on finding the effective measures to defend against threats presenting the most critical risks to cloud customers, so rather than summarize this threat actor’s history or further discuss their