Extortion · March 22, 2022 · 5 min
LAPSUS$: teenagers from Brazil and London humiliate Microsoft, Nvidia, and Uber
MedellínSoftware · Medellín, Colombia
This was not a military-budget APT. It was Telegram, SIM swapping, and bought employees. Okta, Rockstar, Samsung. The new fear: a minor with Discord.
medellinsoftware.com/story/lapsus-adolescentes-vs-microsoft-nvidia-uber/
Age
16–22
Victims
Microsoft, Uber, Nvidia
Method
Social + SIM swap
Arrests
UK · 2022
LAPSUS$ did not use million-dollar zero-days. It used people. Bribes to employees, fatigued MFA, SIM swapping, help desks that reset too easily. In 2022 the group — with a core in Brazil and a teenage leader in Oxford — walked through Nvidia, Samsung, Microsoft, Okta, Uber, and Rockstar.
They posted on Telegram as a trophy. Source code from giants, in the open. British police arrested several. The reputational damage was already done: if a kid gets in, the trust model is broken.
The playbook is people: a contractor gets bought, a second factor gets fatigued, and the real perimeter starts with humans, not the firewall.
The desk
The file is public. The briefing is requested.
AI and deep military intelligence. Medellín.