LAPSUS$: Recent techniques, tactics and procedures

This research was conducted by David Brown, Michael Matthews and Rob Smallridge from NCC Group Cyber Incident Response Team. You can find more here Incident Response – NCC Group

tl;dr

This post describes the techniques, tactics and procedures we observed during recent LAPSUS$ incidents. Our findings can be summarised as below:

Access and scraping of corporate Microsoft SharePoint sites in order to identify any credentials which may be stored in technical documentation.

Access to local password managers and databases to obtain further credentials and escalate priv…