Lapsus$ Bites Impresa: A Ransomware Attack on Portugal’s Media Giant

Summary

The Lapsus$ ransomware group launched a significant attack against Impresa, Portugal’s largest media conglomerate, in early 2022. The attack disrupted Impresa’s online presence, including websites and streaming services, and the group even gained access to Impresa’s AWS account and social media. This incident highlights the growing threat of sophisticated ransomware attacks against high-profile targets.

Explore the data solution with built-in protection against ransomware TrueNAS.

Main Story

The Lapsus$ ransomware group certainly didn’t waste any time kicking off 2022; they went straight for Impresa, Portugal’s big media player, with a very public attack. Now, Impresa, if you’re not familiar, owns SIC – that’s the country’s largest TV channel – and Expresso, a major weekly newspaper. So, basically, they hit the big time. And, as you can imagine, it threw their online operations into complete chaos right at the start of the new year.

This attack, it really highlighted the increasing sophistication, and frankly, the audacity of these ransomware groups. They’re clearly not afraid to go after prominent organizations. It’s not just about the money anymore, it seems.

But it wasn’t just data encryption. Oh no, Lapsus$ aimed for maximum disruption and embarrassment for Impresa. It’s like they wanted to make a real statement. They defaced Impresa’s websites with their ransom note – they even bragged about getting into their Amazon Web Services (AWS) account. And, that wasn’t enough! They then went on to hijack Expresso’s verified Twitter account, using it to taunt Impresa and basically show everyone that they had complete control. Imagine waking up and seeing that.

Now, thankfully, Impresa did manage to regain control of their AWS account and put their websites into maintenance mode. However, the impact of the attack was, well, pretty significant. Their entire online presence was knocked offline, you know, websites for Impresa, Expresso and all the SIC TV channels. Sure, the national TV broadcasts continued, but SIC’s internet streaming capabilities? They were down for the count. It really underlines the impact these kinds of attacks can have, even if they don’t hit every service.

It’s worth noting, the Impresa attack wasn’t some kind of one-off. Lapsus$ had already targeted a bunch of other high-profile organizations. For instance, Brazil’s Ministry of Health and some big South American telecom providers like Claro and Embratel. These guys weren’t messing around. Their tactics included everything; data exfiltration, website defacement, and social media hijacking, which, all told, showed a shift towards a much more aggressive, and disruptive style of ransomware. It wasn’t just about locking up files anymore.

Looking at the Impresa attack, a few key trends really jump out:

• Targeting High-Value Assets: Lapsus$ went straight for Impresa’s online presence, trying to disrupt their core business and completely trash their public image, by targeting their websites and social media. This was clearly designed to amp up the pressure to pay. It’s like saying, “we know where it hurts most”.

• Double and Triple Extortion: They went beyond simply encrypting data. Lapsus$ engaged in data exfiltration, threatening to release it all if they didn’t get paid. This “double extortion” tactic is increasingly common, unfortunately. And, not stopping there, they used the hijacked social media to further shame and put pressure on their victim, that’s what they call ‘triple extortion’.

• Focus on Disruption and Embarrassment: There is a clear shift away from just the financial gain. Lapsus$ really wanted to cause maximum disruption and embarrassment, using reputational damage and business interruption as leverage. That’s a lesson for us all, isn’t it?

• Increasing Sophistication: Their ability to compromise AWS accounts and hijack social media highlights a high level of technical skill, and a willingness to exploit vulnerabilities in cloud services and online platforms. This isn’t some amateur hour operation; these guys know what they are doing.

The Impresa incident? It should serve as a real wake-up call. It’s a stark reminder that the ransomware threat is evolving. Organizations must prepare for more aggressive and sophisticated attacks. These attacks won’t just target data, they’ll go after brand reputation and business operations too. So, robust cybersecurity measures are absolutely critical. Strong access controls, multi-factor authentication, regular data backups, and effective incident response plans; all of that is non-negotiable. And you know, employee training and awareness? It’s equally important to defend against the social engineering tactics that these ransomware groups love to use. Don’t let your employees be the weak link. If anything, I’m more interested in the impact on our digital world in the future.