Hacking group claims to leak Microsoft source code

A threat actor that has previously stolen and leaked data from Nvidia and Samsung now claims it has posted Microsoft source code for Bing, Bing Maps and Cortana on its Telegram channel.

The threat actor, Lapsus$, which is believed to operate in South America, posted the claim on Telegram at 6:17 p.m. PST on Monday.

On Sunday, Lapsus$ had posted a screenshot that it claimed were source code repositories from Microsoft, including for Bing and Cortana.

The group claimed it had accessed the repositories by hacking an Azure DevOps server. The screenshot was later deleted without explanation. “Will repost later,” the group had said.

In response, Microsoft had released a statement saying the company was in the process of investigating the claims.

The new Telegram post on Monday includes a 483 KB file, which Lapsus$ claims contains a portion of the source code for Microsoft’s Bing search engine, Bing Maps service and Cortana virtual assistant. The group suggested that the file includes 90% of the Bing Maps data it claims to have stolen, and 45% of the Bing and Cortana data that it claims to have stolen. “Enjoy everyone!” the post reads.

VentureBeat has reached out to Microsoft for comment on the latest claims by Lapsus$.

“Given the lack of a denial from Microsoft and Lapsus$’ past victims, their claims are not entirely implausible,” said Brett Callow, a threat analyst at Emsisoft, in a message to VentureBeat. “The gang seems to be somewhat disorganized, which could indicate they’re relatively inexperienced – and that makes the fact they’re able to hit major corporations somewhat surprising.”

Over the past month, vendors including Nvidia and Samsung Electronics confirmed the theft of data by the threat actor. On March 1, for instance, Nvidia said that “we are aware that the threat actor took employee credentials and some Nvidia proprietary information from our systems and has begun leaking it online.”

Stolen Nvidia data reportedly included designs of graphics cards and source code for DLSS, an AI rendering system. 

Experts have said that Lapsus$’ motives haven’t been clear, given the lack of financial demands in the past.

Originally appeared on: TheSpuzz