Pierluigi Paganini
March 22, 2022
Microsoft recently announced that is investigating claims that the Lapsus$ cybercrime gang breached their internal Azure DevOps source code repositories and stolen data.
On Sunday, the Lapsus$ gang announced to have compromised Microsoft’s Azure DevOps server and shared a screenshot of alleged internal source code repositories.
One of the repositories contains the source code for Cortana and other Bing projects (e.g. ‘Bing_STC-SV’, ‘Bing_Test_Agile’, and “Bing_UX’).
After the initial announcement, the group has removed the initial announcement from its Telegram channel, and posted the message “Deleted for now will repost later”
Now the cybercrime gang claims to have leaked the source code for some Microsoft projects, including Bing and Cortana.
This night (March 22) the group shared a torrent for a 7zip archive containing 9 GB of Microsoft source code. According to BleepingCompyter, the archive contains the source code of over Microsoft 250 projects.
“Leak of some Bing , Bing Maps and Cortana source code – Bing maps is 90% complete dump. Bing and Cortana around 45%.” reads the message published by the gang on their Telegram channel.
The archive contains 37GB of source code allegedly belonging to Microsoft
This data leak could have a serious impact on the company if it will be confirmed the authenticity of the leaked files. The documents are for internal use and contain a lot of sensitive information that could be used by a threat actor to carry out additional attacks. The source code could be also analyzed to find zero-day flaws that can be used to target the customers of the company.
Over the last months, the Lapsus$ gang compromised other prominent companies such as NVIDIA, Samsung, Ubisoft, Mercado Libre, and Vodafone.
On Thursday, March 10, the group announced they’re starting to recruit insiders employed within major technology giants and ISPs, such companies include Microsoft, Apple, EA Games and IBM. Their scope of interests includes – major telecommunications companies such as Claro, Telefonica and AT&T.
Notably, the actors are looking to buy remote VPN access and asking potential insiders to contact them privately via Telegram, they then reward them by paying for the access granted.
At the time of this writing, the group also claimed to have compromised the company Okta.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Microsoft)
[adrotate banner=”5″]
[adrotate banner=”13″]
