A new financially motivated threat group named “LUCR-3” has been discovered targeting organizations to steal intellectual property for extortion. This threat actor surpasses Scatter Spider, Oktapus, UNC3944, and Storm-0875.
LUCR-3 is targeting Fortune 2000 companies in various sectors, which include Software, Retail, Hospitality, Manufacturing, and Telecoms. The threat actor uses existing identities for initial access instead of relying on Malware.
As part of the initial access, the threat actor performs recon on the victim identities to choose the user who will have necessary access for their exploitation.
More often, they rely on social engineering, smashing, or buying the credentials that are available on the deep web marketplace. Most of their victims have been identified as Admins, Developers, Engineers, and the Security team.
The credentials they use are legitimate for connecting to the target network and applications. With these credentials, they perform MFA bypass using various techniques like SIM Swapping, Push Fatigue, Phishing attacks, or buying a social engineer access through insider threats. They also modify MFA settings by registering a new device or adding alternative MFA options.
Moreover, this threat actor has a unique way of understanding the organizations by following a regular employee method – Viewing and searching the documents available on SharePoint, OneDrive, knowledge applications, ticketing solutions, and chat applications that provide in-depth knowledge about the victim organization. This method is carried out in the case of SaaS applications.
In the case of AWS, they leverage the billing and AWS management console for understanding the cloud infrastructure.
They also use Systems Manager (SSM) to run AWS-GatherSoftwareInventory, which will provide complete information about all the EC2 instances and the software running on them.
For gaining persistent access into the compromised systems, the threat actor relies on previously available tools like device registration, alternate MFA, and strong authentication type (from 6 [PhoneAppOTP] to 7 [OneWaySMS]).
In the case of AWS, the threat actor creates a user, access, and login profile (or updates a login profile). A complete report about this threat actor has been published by Permisio, which provides detailed information about the infiltration, extraction, and other details.
As part of Defense evasion, LUCR-3 uses GuardDuty disabling, stopping the logging and serial console access. In certain cases, they also send emails relating to helpdesk tickets, the creation of authentication keys, access tokens, and OAuth.
| Name | Type |
| P0_AWS_ACCESSKEY_CREATED_1 | Alert |
| P0_AWS_CLOUDTRAIL_LOGGING_STOPPED_1 | Alert |
| P0_AWS_CLOUDTRAIL_TRAIL_DELETED_1 | Alert |
| P0_AWS_EC2_ROOT_USER_SSH_1 | Alert |
| P0_AWS_EC2_SERIAL_CONSOLE_ACCESS_ENABLED_1 | Alert |
| P0_AWS_GUARDDUTY_STATUS_CHANGED_1 | Alert |
| P0_AWS_NEW_USER_CREATED_1 | Alert |
| P0_AWS_S3_BROWSER_USERAGENT_1 | Alert |
| P0_AWS_SM_GETSECRETVALUE_CLOUDSHELL_1 | Alert |
| P0_AZUREAD_MFA_FACTOR_ROTATION_1 | Alert |
| P0_AZUREAD_MFA_FACTOR_ROTATION_BY_ADMIN_1 | Alert |
| P0_GIT_CLONE_ALL | Alert |
| P0_IDP_MFA_DEVICE_DOWNGRADE | Alert |
| P0_IDP_MFA_ECOSYSTEM_SWITCH | Alert |
| P0_IDP_MFA_EXTERNAL_EMAIL | Alert |
| P0_IDP_MFA_MANYUSERS_1DEVICE | Alert |
| P0_INTEL_LUCR3 | Alert |
| P0_OKTA_MFA_FACTOR_ROTATION_1 | Alert |
| P0_OKTA_MFA_FACTOR_ROTATION_BY_ADMIN_1 | Alert |
| P0_SAAS_CREDENTIAL_SEARCH | Alert |
Source: Permisio
Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.
A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…
Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…
The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…
Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…
A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…