Cyber Safety Review Board’s Report Exposes Tactics of Hacker Group Lapsus$

The Cyber Safety Review Board’s report released on Thursday showed that the hacking group known as Lapsus$ uses simple techniques to evade industry-standard security tools. The report, which was delivered to President Biden through Department of Homeland Security Secretary Alejandro Mayorkas, also outlined 10 recommendations on improving public and private sectors’ protection against Lapsus$ and similar groups.

According to Mayorkas, the recommendations are timely and actionable and contain guidance from cybersecurity practitioners in the private sector, the DHS said.

The CSRB prepared the report after consultations with close to 40 cybersecurity organizations and individuals including international law enforcement agencies and targeted entities.

The CSRB report found that Lapsus$ and other cyber threat actors primarily used ordinary techniques, such as phishing employees’ online accounts and stealing cell phone numbers to access companies’ proprietary data. 

The report also noted that organizations have failed to account for the vulnerability of voice calls and using text messaging for multi-factor authentication. Suggested remedies include switching to more secure, password-less and easy-to-use solutions and more stringent authentication methods of cell phone carriers.