2022 LastPass Password Vault Theft Traced to Home Computer of DevOps Engineer

By Scott Ikeda for CPO Magazine
Friday, March 3, 2023

• 1.3k
• 24
• 28
• 24
• 16
• More
• 24
• 24
• 24

A late 2022 theft of LastPass’s decrypted password vaults has been tracked to one of the company’s DevOps engineers, as attackers reportedly targeted a vulnerability in a media software package on the employee’s home computer. The victim was reportedly one of only four employees at the company that had access to a shared folder that provided the keys to customer vaults.

Dr. Ilia Kolochenko, Founder of ImmuniWeb, anticipates a coming “surge” of highly targeted attacks on individual employees: “This is an emerging vector of sophisticated cyber-attacks: targeting victim’s employees, who have privileged access to internal systems, instead attacking the victims directly. Following a series of devastating supply-chain attacks in the last three years, most organizations now take their third-party security extremely seriously and significantly limit data sharing with their external suppliers or vendors. Creative cybercriminals have, however, discovered another low-handing-fruit attack vector – a grim derivate of the pandemic and working-from-home trend – victim’s employees.”

“Moreover, when working-from-home employees are using employer’s equipment, many foundational security tasks, such as timely installation of patches or restrictions to use unvetted software, may become less efficient and flawed. Eventually, instead of running frontal attacks against a well-protected corporation, cyber gangs stealthily steal the “keys to the Kingdom” from a breached employee’s machine. Worst, such intrusions are hardly detectable by various anomaly detection systems and thus oftentimes remain unnoticed. In 2023, we should expect a surge of sophisticated attacks on privileged tech employees aimed at stealing their access credentials and getting access to the “Crown Jewels”. Organizations should urgently consider reviewing their internal access permissions and implement additional patterns to be monitored as anomalies, such as excessive access by a trusted employee or usual access during non-business hours,” added Kolochenko. Read Full Article