Thread by @BillDemirkapi

The LAPSUS$ ransomware group has claimed to breach Okta sharing the following images from internal systems.

The screenshots are very worrisome. In the pictures below, LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords:

Another scary note is the date in the VM used in the screenshot consistently appears to be January 21st, 2022. If this date is correct, this would suggest @okta failed to publicly acknowledge any breach for at least two months.

LAPSUS$ edited their message to clarify that they did not breach Okta's databases, but rather targeted Okta customers.

LAPSUS$ appears to have gained access to some company VPNs given the Cisco AnyConnect icon and the GlobalProtect window in this image.

More screenshots demonstrating access to "superuser", perhaps Okta's administrative access panel? Other access includes Jira and Slack for Okta.

This RDP server in one of the screenshots "rdp[.]chrisro[.]fun" is still active. Perhaps part of LAPSUS$ internal infrastructure? Hosted in AWS (us-west-2) @awscloud @AWSSecurityInfo

Interesting note. The "chrisro[.]fun" domain is registered to "SYKES LATIN AMERICA" and in this screenshot below we can see some tool in the taskbar named "SYKES Secur...".

It is possible that LAPSUS$ might have gotten all this access by abusing Okta's own remote control tooling they use to spy on their employees. It would explain things like why the Chrome browser is signed into a user.

That rdp[.]chrisro[.]fun domain likely isn't part of LAPSUS$ infrastructure. It likely belongs to "Christian Rojas" from Okta whose account was compromised ("chrisro" = "Christian Rojas"). Pointing this out to clarify an earlier incorrect assumption.

Okta's CEO @toddmckinnon has released a statement, publicly admitting Okta knew about the breach for two months yet told no one about it... 🤔

Okta has just now published another statement providing slightly more details. Interesting to hear Okta say they were not breached and the attempt was "unsuccessful" while at the same time admitting some customer data was accessed. okta.com/blog/2022/03/u…

The LAPSUS$ ransomware group has issued the following response to Okta's statement.

I've had a lot of questions around "How could LAPSUS$ abuse their access to attack Okta customers?". Through the customer support panel, LAPSUS$ had the ability to view customer data AND reset MFA for any employee of a customer.

LAPSUS$ could perform a credential stuffing attack on customers and if they could find an employee account which had an insecure password, they could bypass MFA by resetting it. The next time they login, they would be prompted to setup MFA for the first time.

Okta has published an updated statement. According to them, about 2.5% of their customers might have had their data leaked / "acted upon". This still brings up the question, why did they do this analysis two months after they became aware of the breach? okta.com/blog/2022/03/u…