Rewterz Threat Update – LAPSUS$ Ransomware Group Breaches Globant

Severity

High

Analysis Summary

LAPSUS$ data extortion is a new and emerging ransomware and extortion group that has successfully attacked major conglomerate. Like most ransomware groups, LAPSUS$ also infiltrates organizations with a phishing attack. From there on, they exploit vulnerabilities like privilege escalation to get hold of administrative rights and blatantly display their abilities. LAPSUS$ Threat group has also breached Globant, and the organization has also released statement on it.

Globant, with it’s HQ in Luxembourg, has well-known customers like Google, Electronic Arts, Autodesk, Rockwell Automation, among others.

“We have recently detected that a limited section of our company’s code repository has been subject to unauthorized access” – Globant

Some of the source code folders listed in the screenshot include, Abbott, apple-health-app, C-span, Fortune, Facebook, DHL, and Arcserve

LAPSUS$ has since published credentials that grant “administrator access” to these platforms used by Globant for collaborating, reviewing, and developing codes. 

The group has since leaked 70GB of customer source code from Globant.

“In terms of legitimacy, going just by volume alone it’s hard to fabricate that amount of data – however samples of the data have been cross referenced with live systems and other methods that show the leak is legitimate and very significant as far as Globant and Globant’s impacted customers are concerned” – SOS Intelligence

Impact

• Financial Theft
• Data Breach

Remediation

• Logging – Log your eCommerce environment’s network activity and web server activity.
• Passwords – Ensure that general security policies are employed including: implementing strong passwords, correct configurations, and proper administration security policies.
• Admin Access – limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
• WAF – Web defacement must be stopped at the web application level. Therefore, set up a Web Application Firewall with rules to block suspicious and malicious requests.
• Patch – Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Secure Coding – Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• 2FA – Enable two-factor authentication.
• Antivirus – Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using a multi-layered protection is necessary to secure vulnerable assets.