Artificial intelligence (AI) and machine learning are positioned to assist today's enterprises as they fight to defend themselves against the rising number of cyber attacks. 

 

Real-time learning and analysis of potential cyber risks is made feasible by AI and machine learning. Additionally, they use computers to create behavioral models, employing these models to forecast cyberattacks as new information becomes available. By accelerating and improving cybersecurity responses, these technologies work together to help businesses strengthen their security defense. 

 

An Effective Tool for Combating Cyber Attacks 

Cyberattacks have increased as more firms adopt digital transformation strategies. According to the Identity Theft Research Center, 2021 has been a record-breaking year in the U.S., with the number of data breaches at the end of the third quarter surpassing all of 2020 by 17 percent. Likewise, ransomware assaults have been rising alarmingly, with the typical incidence costing businesses over $700,000. Today, a ransomware assault occurs every 11 seconds, causing a 21-day company outage average. 

 

AI and machine learning can guard against these advanced threats, which hackers are using to shut down business networks. In fact, these technologies are rapidly advancing into commonplace tools for cybersecurity experts in their continuing battle with malicious actors. 

 

61 percent of firms said they won't be able to recognize major risks without AI, and 69 percent think it would be vital to counteract cyberattacks, according to a survey by Capgemini Research Institute. In fact, it is predicted that the market for AI in cybersecurity would reach $46.3 billion by 2027. 

 

• Finding anomalies: To find abnormalities that could be signs of an assault, AI and machine learning employ behavioral analysis and constantly changing parameters. 
• Future data breaches can be predicted thanks to AI and machine learning, which allows for the processing of vast volumes of data of various kinds.
• Real-time data breach response: AI and machine learning can deliver notifications when a cyber danger is discovered, or they may act independently without human assistance by automatically generating protective patches as soon as an assault is discovered. 

 

Benefits of AI and Machine Learning 

AI and machine learning are having a significant positive impact on cybersecurity programs at organizations. These consist of: 

 

• Increasing the speed of detection and response: AI and machine learning are far faster at identifying dangers than humans because they can quickly examine vast volumes of data. Furthermore, they may rapidly improve reaction times by applying fixes and removing threats in almost real-time. Todays cyberattacks may swiftly infiltrate an organization's infrastructure; thus, success depends on having razor-sharp detection and reaction times. 
• Lowering IT costs: AI and machine learning are efficient technologies because they need less work to detect and address cyber risks. According to the Capgemini analysis, the average cost reduction is 12 percent, with some firms achieving cost reductions of more than 15 percent. 
• Increasing cyber analyst effectiveness: By reducing the amount of time needed to manually go through data logs, AI and machine learning lighten the strain for cyber analysts. These systems can notify cyber analysts of an assault while categorizing the attack's nature, better enabling them to respond appropriately. Cyber analysts are more capable of handling even the most complicated risks with less manual work when behavior patterns are continuously and thoroughly analyzed. 
• Improving your overall security posture: As more data is reviewed and these systems learn from previous patterns, cybersecurity grows stronger with time as they become more adept at spotting questionable activities. Additionally, they safeguard an organization's infrastructure on both a global and micro level, erecting barriers that are more effective than those made by manual techniques. 

 

Potential Uses 

Although there are risks associated with AI and machine learning, their usage is only anticipated to grow in the future. These technologies have already shown themselves to be quite successful in a variety of application scenarios. The following are some typical use cases where businesses are effectively utilizing AI and machine learning: 

 

• Rapidly detect intrusions: AI is now being used by businesses to automatically and precisely identify criminal activities. Organizations are responding to incursions as soon as they happen because to machine learning's capacity to identify, evaluate, and defend against cyber threats in real-time. 
• Identifying suspicious behaviors: To identify questionable user activity, AI and machine learning are also applied. Organizations use machine learning to differentiate between typical behavior and aberrant behavior that may be the sign of a cyber attack in order to fix vulnerabilities until a data breach occurs. This is done by monitoring users' unexpected actions, such as when they log in at odd hours of the day or download an unusually high volume of data. 
• Detecting fraud: Many businesses use machine learning algorithms to anticipate anomalous client behavior in order to protect themselves against financial fraud. These technologies are assisting companies in identifying potential fraud risks before they materialize, hence minimizing their financial losses. They do this by having the swift capacity to identify if client behavior is abnormal.
• Discovering malware: Organizations are using AI and machine learning to forecast malware outbreaks in the future. Cyber analysts can foresee malware assaults and quickly mitigate the danger using machine learning, which uses patterns discovered in past infections. 

 

Planning Your Implementation 

It may be tough to know where to begin when integrating AI and machine learning into one's cybersecurity strategy, which is why many firms find it problematic. As you start implementing your implementation strategy, keep the following advice in mind to get the greatest results: 

 

• Employ competent cyber analysts who are well-versed in the use of AI and machine learning and decide which jobs you want to automate and which you'd rather have handled by people. 
• Ascertain that you have the data sets required to start employing AI algorithms, that this data is accurate and current, and that it is properly linked with your applications and infrastructure. 
• Set defined success criteria for these test projects, starting with just one or two use cases that are simple to deploy and provide real value for your business. 
• To validate, rank, and assess possible risks, create a clearly defined methodology. 
• Create control mechanisms to aid you in recognizing when an AI system deviates from expected behavior so you can quickly resolve any problems. 
• As you integrate AI and machine learning into other aspects of your cybersecurity strategy, evaluate the outcomes of your test projects and make any required adjustments. 

 

Powerful Tools for An Escalating Problem. 

AI and machine learning are potent tools that may aid firms in becoming more prepared as the volume and sophistication of cyberattacks rise. Your firm can identify and respond to cyberattacks in real-time with the correct technologies in place, while also resolving potential risks before they become major problems. As a consequence, you can better manage the pace and scope of today's risks and discover threats sooner, for less money, and with a security posture that is stronger. 

 

How Lumifi Can Help 

We not only utilize the industry’s leading threat intelligence platforms, but also deliver personalized security recommendations through scheduled calls with a dedicated Engagement Manager. Our suite of services allows you peace of mind knowing your organization is being monitored around the clock by an industry leading SOC which takes pride in its customers' security.   

 

Cloud Attacks: Are You Still Safe? 

95% of respondents are using the cloud, according to the 2016 State of the Cloud Survey. The nature of cloud-based computing offers the prospect of severe cloud security breaches despite its fast expansion, which can significantly harm an enterprise. One of the top worries is data security.

 

How can IT administrators maintain flexibility, data access, and innovation while still protecting themselves (and their companies)?

 

Let's look at 7 recommendations to protect your company against cloud security concerns.

 

1. Educate your employees.

There is a simple reason for the security concerns in the majority of organizations: unaware staff. You may reduce risk and stop cloud security risks by educating your personnel on suitable protection techniques:

 

Include the entire organization. Employees are more inclined to own up to their responsibilities regarding security measures when they actively participate in safeguarding corporate assets. Engage the whole staff in security training and inform them of future best practices.

Make a plan. Establish a reaction plan in case staff members believe their privacy has been violated. To ensure that users are always ready, create a document that outlines the actions they should do in various circumstances.

Conduct ad hoc security testing. It's crucial to educate your staff, but only if they remember the knowledge.

 

2. Secure a data backup plan.

The risk of irreversible data loss is increasing as the cloud develops. A secure backup of such data should be prepared for anything.

 

For enhanced security, IT administrators should spread data and applications over several zones and follow industry best practices for disaster recovery, offsite storage, and regular data backup.

 

3. Encryption Is Critical

For protection, cloud encryption is essential. It enables the encryption of text and data before it is uploaded to a cloud storage system.

 

Find out from your provider how data is managed. You may encrypt at the network's edge to guarantee the security of your data before it leaves your company, guaranteeing the transit of data in the cloud is safeguarded. Keep the encryption and decryption keys after the data has been encrypted. If you have both of these, any demands for information will require the owner's involvement even if the data is kept by a third-party supplier. Avoid storing encryption keys in the program that houses your data. IT departments must maintain physical control over encryption.

 

4. Passwords Matter

Considering that passwords are used to encrypt and compressed data, selecting one carefully is crucial. 90% of passwords can be broken in a matter of seconds.

 

According to Duncan Stewart, director of technology for Deloitte Canada, "passwords having at least eight characters, one number, mixed-case letters, and non-alphanumeric symbols were originally regarded to be strong." However, with the development of advanced technology and software, these may be readily hacked.

 

Despite the propensity for password reuse caused by our limited capacity to recall complicated credentials, avoid taking that risk. Create unique, distinctive passwords to fend against hackers.

 

5. Test, Repeat, Test Again

Think like a criminal while putting safeguards in place to secure your cloud. Penetration testing, a process in IT security intended to find and fix vulnerabilities as well as reduce cloud security risks, is one of the best ways to do this.

 

Here are some things to remember:

 

Be careful to alert your cloud provider before starting a penetration test because it resembles an actual assault.

Make a list of the things you need to test, such as servers and apps, and assess your weaknesses.

 

Keep in mind that internal dangers are just as likely as external ones when you develop your cloud penetration testing strategy.

What do Microsoft, Okta, T-Mobile, Nvidia, and LG all have in common? Well, for starters, they have all been extorted by one of the most prolific and unpredictable hacking groups of 2022.

 

The group coined, LAPSUS$, remarkably infiltrated and extorted a handful of the largest, pre-imminent tech giants in the world through a unique approach of SIM-swapping, social engineering, malware, and other means to enact their financially-driven motives, such as threatening the public release of proprietary data or simply dumping private data on their digital channels for all to see which certainly separates them from other “successful” hackers and groups of the last several years, not to mention they may all be between 16-21 yrs. old.

 

Let’s take a deep dive into the psyche of LAPSUS$ and what exactly makes them so dangerous, yet so bewildering.

 

Who Is Truly Behind LAPSUS$? 

Uncovering the leader or “brains of an operation” can culminate in immense understanding and ultimately dismantling of a criminal organization, but unfortunately, this cohort seems to work in a decentralized manner, closer to chaos than order. Some of the infamies certainly arise from their childish antics, leading to assumptions of inexperience.

 

The list of high-profile attacks would be enough for most cyber criminals to “hang it up” and relinquish to the dark recesses of the internet to preserve earnings and evade detection, but LAPSUS$ touts these victories via a public “Telegram” channel as well as polling viewers on their next “hit”. The social community seems to be the bread and butter of this group, alluding even further into their adolescent composition.

 

 

The LAPSUS$ group hit headlines in December of 2021, with a barrage of attacks against South American companies, including Brazil’s Ministry of Health and other government agencies in the area, before expanding their scopes onto larger, multinational companies to truly catapult into the limelight. At this point, the group had the full attention of the cybersecurity community and didn’t intend to squander it.

 

Fame and fortune stood around the corner as the group shifted to the pillars of international tech giants as their next prey, hoping to utilize their immense influence and coverage to the group’s advantage.

 

As stated via their Telegram channel, LAPSUS$ negates any state or political motives for their extortion attacks, leading some to question the seemingly randomized actions of the group. Is there a collective goal beyond notoriety and wealth?

 

 

How Does LAPSUS$ Operate? 

Microsoft released a ground-breaking report in March of 2022, outlining LAPSUS$’s operational inner workings with speculation on how they were able to extort the largest tech giants in the world. The report did not divulge the members of the group, but rather their model of pure destruction and social engineering methodologies used to extract data from even the most secure of systems.

 

While the group may be comprised of juvenile counterparts, Microsoft repeatedly spoke on the intricate, elaborate, and downright cunning methods used, similar to the most mature threat actors.

 

Let’s take a look at their strategies.

 

Telegram Channel 

LAPSUS$ proved time and time again, that they are to be taken seriously regardless of the make-up of their group, forcing C-suite cybersecurity executives to take notice swiftly. Microsoft stated they tend to gain seemingly impossible access via “social engineering” involving the bribing of employees at targeted locations within customer support call centers and/or various help desks.

 

Microsoft wrote, “Microsoft found instances where the group successfully gained access to target organizations through recruited employees (or employees of their suppliers or business partners)”

 

LAPSUS$ recruits “insiders” via social media channels since the beginning of their attacks, using nicknames such as “Oklaqq” and “WhiteDoxbin” to name a couple. These recruitment posts offered upwards of $20k/week to informants employed within companies like AT&T, Verizon, and T-Mobile. Their message was simple, just get us in the door and we will do the rest.

 

 

SIM-Swapping Method 

SIM swapping is most simply described as transferring one’s mobile phone number (the target) to another device owned by the hacker. This opens the doors for attackers to receive those unique one-time codes & passwords for easy access to protected systems, while potentially gaining the ability to reset passwords for total control.

 

“Their tactics include phone-based social engineering; SIM-swapping to facilitate account takeover; accessing personal email accounts of employees at target organizations; paying employees, suppliers, or business partners of target organizations for access to credentials and multifactor authentication (MFA) approval; and intruding in the ongoing crisis-communication calls of their targets,” Microsoft explained.

 

Unit 221B, an advanced cybersecurity consultancy from New York, shadows cybercriminals performing SIM-swapping as well as keeping tabs on members of LAPSUS$ before their group ever formed (and still does). The group’s techniques, while wildly effective, are not unique, as this form of SIM-swapping has been heavily focused on within major phone companies for many years. Allison Nixon, Chief Research Officer of Unit 221B, exclaimed, “LAPSUS$ may be the first to make it extremely obvious to the rest of the world that there are a lot of soft targets that are not telcos,” Nixon said. “The world is full of targets that are not used to being targeted this way.”

 

The group also employs a malicious malware program called, “RedLine Stealer” or simply “RedLine”, which can be found on hacker forums for purchase and is commonly used for theft of information and infection of entire systems. Logins, passcodes, autofill data, and even stored payment info can be uncovered and extracted to access a plethora of personal accounts such as:

• Social Media
• Email
• Banking
• Crypto wallets, and more

 

RedLine Stealer was once again put into action by LAPSUS$ against Electronic Arts (EA), threatening to reveal 780 GB of proprietary source code, unless a hefty payment was received. The hackers revealed they gained control of EA’s data via authentication cookies purchased from the dark web in a marketplace called, Genesis.

 

“The existence of this leak was initially disclosed on June 10, when the hackers posted a thread on an underground hacking forum claiming to have EA data, which they were willing to sell for $28 million. The hackers said they used the authentication cookies to mimic an already-logged-in EA employee’s account and access EA’s Slack channel and then trick an EA IT support staffer into granting them access to the company’s internal network,” wrote Catalin Cimpanu for The Record.

 

 

Social Engineering & Corporate Extortion 

Social engineering attacks work by stealing credentials that allow for data theft and other debilitating means via psychological manipulation of individuals to release critical data to attackers. Microsoft stated LAPSUS$ received “intimate knowledge” of various companies through these tactics allowing them unbelievable front-door access to systems.

 

LAPSUS$ was known to frequently dial help desks, sometimes bribing or tricking employees into resetting critical account information, and then learning how they handled these security invasions by listening in on comm channels like Teams and Slack. The group used this “training session” to truly understand the methods and protocol these organizations went through to deter the very attack the group planned to carry out. This insider knowledge allowed them to circumnavigate all security points and remain hidden within the system while formulating further plots for extortion.

 

Microsoft released a statement, “The group used the previously gathered information (for example, profile pictures) and had a native-English-sounding caller speak with the help desk personnel to enhance their social engineering lure. Observed actions have included DEV-0537 answering common recovery prompts such as “first street you lived on” or “mother’s maiden name” to convince help desk personnel of authenticity.”

 

Initial access is granted through various methods, such as using RedLine, searching public code repositories, and even purchasing remote access credentials via the dark web. Of course, more straightforward approaches such as directly paying employees for access also proved worthwhile.

 

Multi-factor authentication seems like a safeguard with minuscule security lapse but LAPSUS$ manages to override these systems through session token replay and even repeatedly spamming account holders with MFA prompts after they successfully gained the password. The hacker group stated in their Telegram chatroom, that upon targeting users during the middle of the night with MFA prompts, their success rates were much higher, since people tend to simply select, “Accept” rather than be interrupted during their precious hours.

 

Data Harvesting and VPNs 

Virtual private networks, also known as VPNs, are another key on the keychain of LAPSUS$, which utilized them in a way that prevented any “impossible travel alerts” from being triggered within the system. These alerts, connected to cloud monitoring services, detect any suspicious activity of all users and logins, making notes on any consecutive login attempts from let’s say Colorado and then another from New York, 5 minutes apart. Hence, the “impossible” nature since one person could not possibly access a system quickly from these locations. Bypassing this feature is a critical step to remain hidden long enough to exfiltrate target data.

 

Microsoft reported, “DEV-0537 has been observed leveraging access to cloud assets to create new virtual machines within the target’s cloud environment, which they use as actor-controlled infrastructure to perform further attacks across the target organization.”

 

Once inside, LAPSUS$ had the power to knock out the business from its cloud platform, giving it absolute control. Next, all inbound and outbound email was to be directed to its infrastructure where data would be harvested before the total deletion of systems. Finally, the group would either publicly unveil the stolen data or use their many extortion tactics to prevent data release.

 

All good things must come to an end…right?

 

Arrests 

Bloomberg releases a breaking report stating the entire operation is being driven by a 16-year-old teenager from Oxfordshire, UK with seven arrests following on March 24th.

 

The 16 yr. old boy's father told the BBC: "I had never heard about any of this until recently. He's never talked about any hacking, but he is very good at computers and spends a lot of time on the computer. I always thought he was playing games."

 

All arrested were immediately released, pending a deeper investigation, with confirmation coming on April 2nd that two individuals were charged with connection to LAPSUS$ and the attacks of numerous tech giants.

 

Offenses included: 

3x counts of unauthorized access w/ intent to impair the operation of or hinder access to a computer.
2x counts of fraud by false representation
1x count of causing a computer to perform a function to secure unauthorized access to a program

 

Both individuals are reportedly on bail with limited details available due to their status as minors.

 

As a cybercriminal group, letting your voice be heard can be an opportunity for increased notoriety, but also lead to increased investigation and scrutiny by law enforcement agencies around the world. The above arrests of a 16 & 17 yr. old came just days after the public unveiling of source code for mobile apps belonging to these companies on March 30th:

• Facebook
• DHL
• Abbot
• AB InBev, and others

 

LAPSUS$’s Payday 

You might be wondering, with the insane prestige included on their “hit list”, how lined is the group’s wallet? Well, speculation has risen that LAPSUS$ has amassed upwards of $160 Million in revenue.

 

This finding is not concrete and has yet to be confirmed by members of LAPSUS$, but their public Telegram channel released details on their crypto wallet containing (3,790.62159317 bitcoin).

 

Where Are They Now? 

LAPSUS$ announced via its Telegram channel, “We created a Element/Matrix chat in the case this Telegram is deleted!

We advise everyone to join it!”

 

This is the last known message of the group, leading to speculation of potential regrouping while finding new paths of attacks after cutting it close with law enforcement. All of these intrusions mentioned in the blog occurred during a 3-month span, so potentially the master plan was to strike hard, and strike fast while jumping out before everything came crashing down.

 

Let us know what you think, have we heard the last of LAPSUS$, or is this just the dawn of a new era of cybercrime?

 

 

Attack Timeline

 

 

Public Wifi & Working From Home

By 2025, upwards of 36 million Americans will have entirely remote or flexible occupations, an 87 percent post-pandemic rise, according to some analysts. One might infer that having the opportunity to work outside of the office has led many employees to select open areas like cafés, diners, railway stations, terminals, and other public locations to do their tasks, increasing the vulnerability of organizations and people to cyberattacks via the dangers of public wifi.

 

Cyber Attacks Are On the Rise

You may believe, "I always use public wifi, and I've never had an issue!" Yes, at least not that you are aware of. The worrying reality is that cyberattacks are increasing along with the number of remote workers, putting everyone who uses public wi-fi in danger. Cyberattacks were ranked as the fifth top risk for businesses in the public and private sectors in a Global Risk Report that was issued in 2020, and it is anticipated that they will soon move up the list. The FBI assessed the financial cost at more than $4.2 billion and recorded 791,790 complaints of suspected cyber crime in 2020, which is 300,000 higher than reported in 2019. The need to safeguard oneself against the dangers of public wifi has never been greater.

 

What Are the Top Dangers of Public Wi-Fi for Businesses?

Most individuals who use public wi-fi networks while working are blissfully oblivious to the danger they run of unintentionally disclosing sensitive, secret, or essential information, which might pose a serious threat in the hands of an experienced hacker. You have probably used the convenience of free public wifi. The top seven risks of using public wifi for business, nevertheless, should be taken into consideration because this is not without significant risk.

 

Malware, Viruses, and Worms

The forced installation of malware, commonly referred to as malicious software, on user devices is one of the main hazards you may encounter when using public wi-fi. All programming and applications developed to damage devices or intercept information fall under this general heading. Hackers can infect the public wifi network, which subsequently spreads to the connected devices. Malware may cause havoc and spy on the systems it infects and comes in a variety of ways. In contrast to worms, which may multiply independently and do much more damage, viruses are a sort of malware that propagates through a host file and are activated and duplicated by a person.

Unencrypted Connections

Hackers may track all file sharing and data transferred between the individual and the server on a public wi-fi network when there is no encryption in place. In an unprotected network, a well-positioned attacker may simply follow the network users who are logged into the router and introduce malicious JavaScript onto their equipment.

Network Snooping

Network spying, which occurs when a hacker employs malicious software on an open wi-fi network to remotely observe the behavior on a third party's laptop, is another popular attack technique. Hackers can use this method to monitor any information transmitted, including passwords, credit card numbers, and other sensitive information.

Log-in Credential Vulnerability

Weak and obvious passwords lead to log-in credential vulnerability. Ensure all of your passwords for websites, applications, and wifi networks are strong and distinctive to avoid this kind of security issue.

System Update Alerts

Hackers are continuously coming up with new techniques to take control of smartphones. False system update alerts with the ability to exfiltrate data are one cunning kind of information theft that targets Android devices.

Session Hijacking

Public wifi networks provide a platform for a practice known as session hijacking, which involves abusing a valid online surfing experience. This is another way that hackers may access a network user's device's data without authorization, making any data about your company incredibly exposed.

 

How Can Businesses Stay Safe on Public Networks?

You must create a solid cybersecurity plan for your web presence and apps to ensure the protection of corporate communications, sensitive data, and other assets.

Here are some strategies for protecting your company from the dangers of open WiFi:

• To safeguard login credentials and add additional protection to the personal information of your users, switch your website over to HTTPS.
• Install a virtual private network (VPN) to provide you with protection by establishing an encrypted tunnel for user activity with end-to-end encryption.
• To prevent hackers from acquiring unnoticed peer-to-peer access, tell staff to disable Bluetooth and WiFi auto-connect.
• Ensure that the firewall is always turned on for remote workers' devices.
• Ensure that anti-malware and anti-sniffing software is installed on all business devices.
• Encourage staff to utilize the mobile hotspot offered by their cell carrier rather than a public wi-fi network that isn't secured.
• Run regular vulnerability checks to find locations where your internet infrastructure is vulnerable.
• Demand that your users generate secure passwords using a combination of letters, numbers, and special characters.
• Establish guidelines so that employees are aware of the risks associated with using public WiFi and how to safeguard themselves and corporate assets from criminal attackers.
• To prevent hackers from acquiring unnoticed peer-to-peer access, tell staff to disable Bluetooth and WiFi auto-connect.