Ultimately, LastPass said, it had AWS to thank: It was the provider’s GuardDuty alerts that flagged anomalous behavior when the attacker attempted to use cloud identity and access management roles to perform unauthorized activities.

The fact that the unfortunate engineer’s valid credentials were used to access a shared cloud storage environment made it more difficult to differentiate between legitimate and illegitimate activities. LastPass said that due to the different tactics, techniques, and procedures (TTPs) used in the attack chain, it had not been immediately obvious that what at first appeared to be two different incidents were actually linked.Īlso, he added, alerts and logging were enabled during events, but did not immediately indicate anomalous behavior that later became more apparent. He added that the engineer in question has been receiving support to strengthen his home network and equipment. “The threat actor then exported the native corporate vault entries and shared folder contents, which contained encrypted secure notes with access and decryption keys needed to access AWS S3 LastPass production backups, other resources cloud-based storage and some related critical database backups. The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gained access to the DevOps engineer’s corporate LastPass vault. capacity and allowed the threat actor to implant keylogger malware. “This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which allowed remote code execution.

Backup lastpass vault