Hacker News Reader

Comment by mrkramer | Hacker News Reader

I was researching cybercrime for years and yea motivations of this adversary are confusing and incoherent so I would rather say they are group of real life and/or internet friends who are having fun showing off and practicing their skills something like hackers who deface websites "en masse".

From what Microsoft said DEV-0537 is opportunistic; they are Purchasing credentials and session tokens from criminal underground forums

Paying employees at targeted organizations (or suppliers/business partners) for access to credentials and MFA approval

Searching public code repositories for exposed credentials

and they are exploiting publicly known exploits in order to infiltrate organizations.

Like somebody already mentioned they are similar to LulzSec in a way they are partially financially motivated, partially hacktivist and partially bragging around but all in all they are doing it for the "lulz".

View on HN

Microsoft: "these are bad guys motivated by theft and destruction, practicing extortion as a business model"

HN: "These are kids doing it for the lulz"

I'm hardly a MS supporter, but the facts seem to be on MS side here. The minute you pay somebody to gather access and then proceed to blackmail the organisation, you are organized crime. Just because they brag about it, it doesn't mean they're in it for the fun; they just think they are untouchable because they're outside US territory.

It is somewhat sad that this can even be considered "hacktivism" these days. Extortion has nothing to do with activism.

> partially financially motivated, partially hacktivist and partially bragging around

Didn't you slightly oversimplify there?

They are impossible to decipher because their demands are changing[0].

Their extortion of Nvidia:

"Remove a feature known as LHR, short for "Lite Hash Rate," or see the further leaking of stolen data."

"We decided to help mining and gaming community," Lapsus$ members wrote in broken English. "We want nvidia to push an update for all 30 series firmware that remove every lhr limitations otherwise we will leak hw folder. If they remove the lhr we will forget about hw folder (it's a big folder). We both know lhr impact mining and gaming."

"Lapsus$ modified its demand. Now, the group also wants Nvidia to commit to making its GPU drivers completely open source. If Nvidia does not comply, Lapsus$ says, the company can expect to see a new leak that would include the complete silicon, graphics, and computer chipset files for all its recent GPUs."

[0] https://arstechnica.com/information-technology/2022/03/cyber...

That's either extremely naive, or just a diversion while they go about something else.

yes it is a method, to observe, profile, then troll someone into creating an opening or leverage

One month ago in my country(Croatia) a high school pupil hacked big Telecom/ISP, stole personal information of 100 000 customers and demanded $500 000 extortion fee so he won't leak all that personal information he stole. Kids are not alright these days; this guys are most likely not kids but they are not your typical cybercriminals who operate in stealth. They are all out/public about their operations and hacks and that's not how financially motivated adversaries act.

Are we surprised there's a hacker equivalent to WallStreetBets? "I bet it all on black" etc.

I think both speak to the mindset of our times for a large segment of the population.

> ... a high school pupil hacked big Telecom/ISP, stole personal information of 100 000 customers and demanded $500 000 extortion fee

I think it's a sign of a cultural shift. Not in hacking but in perception of money.

Money used to have this unique value, representing work somebody has put in.

Nowadays real money is increasingly looking like some dumb in-game currency, generally useful only for buying cosmetics and consumables. Awarded arbitrarily, so some people and organisations have awarded themselves or cheesed out of others completely astronomical amounts of it. And on the low end you might doing three job-quests every day and still not have enough for consumables you need daily just to play the game without suffering too much.

Governments apparently are able to pull hundred billions out of their a-ses to buy bunch of tanks from whomever despite lamenting poor economy just a while ago.

In the eyes of the kid demanding 500k RL karma points is not a crime, just trying to utilize opportunity similar to those so many old folk already apparently exploited. Because there's no way they could earn it by working average job.

This a very insightful take on the current crypto and hacking cultures. Some people literally hoard money like dragons, then the megacorporations buy anything that threatens their virtual monopolies, then the rulers make questionable decisions that seem against the public good. The game feels rigged, and some people are tired of it and trying to play by other rules or plainly cheat.

People who (like many of us HN readers) can live well playing by the rules are the NPCs.

>I think it's a sign of a cultural shift. Not in hacking but in perception of money.

I think it is cultural shift in both hacking and in money. Computers and internet enabled kids to consume unlimited amount of information, it enabled them to learn, communicate and play around easier than ever. Some of them play video games and some of them play with "hacking". Hacking is something like stealing money from other kids but nowadays it is in the digital realm and not only stealing money from other kids but stealing money from everybody.

On the other hand there are cryptocurrencies which enabled them to move money around with ease and without any legal requirements. It's not like the underaged high school kid could open a bank account and then demand extortion payment to be made. The only thing he must do is to download a Bitcoin wallet.

But I agree with your assertion that the line is blurred between hard cash and digital cash including in-game currencies, cryptocurrencies plus all other digital representations of value.

its not really the kind of cultural shift you think it is, the world gets more and more competitive each day and if you view this from the perspective of a high schooler, you can see its not as easy as it was 10 or 20 years before, the motivation is not just for fun or have money to spend on "wants", its rather money to survive in this world where competitiveness is too high for some, as a fellow high schooler i say this

But do you realize if you get caught you will go to jail and your competitiveness goes to zero instantly; not only in the present but also in the future because ex-convicts are having a hard time finding a job.

>you can see its not as easy as it was 10 or 20 years before

It was never easy. In the past living standards were lower and there was less education available hence 90% of people were farmers with no education or very little formal education.

> Microsoft: "these are bad guys motivated by theft and destruction, practicing extortion as a business model"

> HN: "These are kids doing it for the lulz"

Who are you gonna trust on that? Salary worshiping corporate security drones? Or a random guy on HACKER News?

Why can’t it be both? Plenty of movies about ruthless mafiosi bragging about their exploits.

I guarantee this is a group of less than 8, most of whom are under 23 and grew up in middle-class Brazilian families and have had access to computers (unfiltered and unmoderated) since age 10.

That's interestingly specific...

the telegram channel name is related to a big hack activity in brazil last year, they always share brazilian news..

It's also a relatively easy, cheap and common opsec strategy to mask your geographic location by constantly sharing news from a place you're not actually located at. Same as saying "good morning" every day to your "team" when actually it's night at your location.

TFA said they started by targeting South American organisations, it tallies that they could be Brazilian.

I read years ago that the US "SEAL Team 6" was named to throw off adversaries (primarily Russia at the time; maybe again now?) that the US actually HAD at least 6 SEAL teams.

This is reminding me of L in Death Note describing how he tracked Kira down to a particular Japanese neighborhood

"Lapsus$ emerged just a few months ago, at first focused almost exclusively on Portuguese-language targets. In December and January, the group hacked and attempted to extort Brazil’s health ministry, the Portuguese media giant Impresa, the South American telecoms Claro and Embratel, and Brazilian car rental company Localiza, among others. In some cases, Lapsus$ also mounted denial-of-service attacks against victims, making their sites and services unavailable for a period of time[0]."

[0] https://archive.ph/20220322060734/https://www.wired.com/stor...

> Like somebody already mentioned they are similar to LulzSec in a way they are partially financially motivated

LulzSec members weren't financial motivated IIRC.

I knew somebody would bring this up; I mentioned financial motivation because these guys in particular are merging the line between financial motivation, hacktivism and bragging about their hacks. On the other hand I know LulzSec wasn't financially motivated but some individual members of LulzSec were involved in criminal activities motivated by profit in their past hacking "careers". LulzSec was all about mocking computer/internet security, bragging about their hacks and making fun about it, all wrapped up in some sort of hacktivism.

Reply on news.ycombinator.com