Lapsus$

That Hansel's so hot right now.

Like, the young crew, uh, the shiny hunters, the Lapsus, the Scattered Spider, um, they are all about phishing, okay? They do some other stuff, but phishing's, like, hot for them.

Social engineering, calling someone, getting them to do things, has been around forever.

Go look at, um, Alethe Denis over at Bishop Fox.

[laughs]

But yeah, back in, back in 2022, a teenager who was a member of the Lapsus$ hacking group, he broke into Rockstar Games, leaked 90 videos of Grand Theft Auto VI.

Obviously, an early development version of the game.

He was caught by the cops, and they obviously didn't want him to do any hacking while he was on bail, and they, they shoved him into a hotel and said, "Look, you're not allowed to go on the internet." It later turned out that he did manage to get on the internet, and even though he didn't have a computer or anything like that, he managed to exploit the Amazon Fire TV Stick plugged into the back of a TV in order to get online.

... sort of sequence.

Like, they're going to do this, uh, voice thing, then they're going to get some sort of access, then they're going to use that access to get something else that they're going to u- So, like, I was just thinking of how Lapsus and-

Mm-hmm

...

No, I, I, I think that's very much intended, um, in this, uh, in this action.

Look, the, the problem you're gonna have with large multinationals is the concerns about both blowback, you know, if you're doing this against criminal groups that can, uh, in like, you know, the comm or, you know, Lapsus type of groups that can target your executives, that can SWAT them.

If you're targeting, uh, you know, a nation state operation, they may retaliate in even more dire fashion.

Um, and then you've got liability concerns as well, how your customers are gonna perceive this.

data points for additional threat actors to do things, right? So number one, I'm thinking this would be super valuable to Shiny Hunters.

Shiny Hunters and Lapsus and Scattered Spider, they are mostly calling help desk and pretending to be someone to get details or credentials reset.

If I have your name, ID, department, reporting structure, et cetera.

I could do that.