This is very much the definition of a targeted attack.Īccording to LastPass, once the attacker was inside the DevOps Engineer’s LastPass corporate vault, they were able to export all manner of potentially useful information. The compromised developer was one of only four people with access to the decryption keys needed to access cloud storage services. The threat actor then exported the native corporate vault entries and content of shared folders, which contained encrypted secure notes with access and decryption keys needed to access the AWS S3 LastPass production backups, other cloud-based storage resources, and some related critical database backups. The attacker was able to access the DevOps engineer’s LastPass corporate vault. After this, the attacker was able to wait until the employee entered their master password and authenticated themselves with multi-factor authentication.

The remote developer’s PC was reportedly compromised via a remote code execution vulnerability in a third-party media player, which was exploited to deploy a keylogger. The credentials allowed the attacker to steal data from Amazon AWS cloud storage servers used by LastPass for a little over two months. The company has now revealed that the individual(s) responsible for the attack also compromised a remote employee's computer, in order to capture credentials used in the second attack. This resulted in a second breach in November, which was revealed by LastPass in December. Last August, LastPass suffered a well publicised breach: Developer systems were compromised and source code stolen.

Last pass security breach