T-Mobile agrees Lapsus$ hackers got internal tools and code

 Mercenary gang LAPSUS$ gained access to T-Mobile networks in March, the telecom company confirmed on Friday, and the company's security was breached.

The acknowledgment came after investigative journalist Brian Krebs shared private internal conversations belonging to the group's core members, which showed that the LAPSUS$ group had breached several times in March before their members were apprehended.

"The bad actor" used stolen credentials to access internal systems, according to a T-Mobile statement," several weeks ago." There was "no evidence that the intruder was able to gain access to customer or government information or other similarly sensitive information," the company stated.

To gain access to T-Mobile employee accounts, the threat actor allegedly used VPN credentials obtained from illegal websites like Russian Market. This would allow the threat actor to conduct SIM swapping attacks at will.

T-Slack Mobile's and Bitbucket accounts were also breached by LAPSUS$, allowing the hacker to download over 30,000 source code repositories from the Bitbucket account.

There's no doubt that LAPSUS$ has gained a lot of notoriety in a short time for its attacks on companies such as NVIDIA and Samsung as well as Microsoft and Okta.

Two of the seven teenagers, a 16-year-old and a 17-year-old, were charged earlier this month by the City of London Police for their alleged ties to the LAPSUS$ data extortion gang.