A London jury has discovered that an 18-year-old member of the Lapsus$ information extortion gang helped hack a number of high-profile corporations, stole information from them, and demanded a ransom threatening to leak the knowledge.
Believed to be one of many leaders of the group, Arion Kurtaj, from Oxford, England, was arrested twice in 2022, first in January after which once more in March, in reference to Lapsus$ hacking exercise.
He’s on trial for breaching fintech firm Revolut, ride-sharing service Uber, and sport developer Rockstar Video games.
Excessive-profile organizations impacted by Lapsus$ additionally embrace Microsoft, Cisco, Okta, Nvidia, T-Cellular, Samsung, Vodafone, Ubisoft, 2K, and Globant.
Leaking information whereas on bail
Kurtaj is autistic and was not deemed match to be in courtroom. Nonetheless, a jury was requested to find out if he was accountable for the alleged hacking exercise, disregarding prison intent.
{The teenager} is believed to have breached the Metropolis of London Police cloud storage after he was arrested in reference to the assault on cellular operator EE.
It’s alleged that after that with the assistance of some Lapsus$ members, Kurtaj focused Revolut, Uber, and Rockstar Video games, demanding hundreds of thousands of U.S. {dollars} in ransoms.
Utilizing the deal with ‘teapotuberhacker’ and whereas on bail at a lodge, Kurtaj leaked gameplay movies from the unreleased Grand Theft Auto 6, obtained after breaching the sport developer’s Slack server and Confluence wiki.
Kurtaj used greater than a dozen on-line names, White and Breachbase amongst them, and is believed to have made greater than 300 BTC from his hacking exercise, SIM-swapping included.
Many of the cash was misplaced to playing or hackers that breached White’s laptop, allegedly twice.
Kurtaj isn’t the one teenager on trial for Lapsus$-related hacking exercise. One other member of the gang, a 17-year-old additionally affected by autism, has been convicted for breaching corporations as nicely.
Regardless of being a loosely organized group of principally youngsters, Lapsus$ managed to breach organizations with a robust sense of safety.
Expert actors nonetheless get caught
A latest report from the U.S. authorities notes that the gang used low-cost strategies to disclose “weak factors in our cyber infrastructure.”
The members of the group took SIM-swapping to the subsequent degree by paying $20,000 per week for entry to a telecommunication supplier’s platform, which allowed them to hijack focused cellphone numbers and procure one-time passcodes to varied accounts.
Lapsus$ exercise unfold from 2021 to 2022 and concerned people from the U.Ok. and Brazil who used social engineering and hacking strategies of varied complexity to breach corporations for fame, monetary sport, and enjoyable.
Final 12 months in September Lapsus$ exercise died, as regulation enforcement began arresting a number of members of the group: a number of people within the U.Ok. [1, 2] and one other one in Brazil.
