Help Desk as Initial Vector

▶ Watch (8:47)

Attackers called the help desk posing as an employee who lost their phone. They provided the last four digits of the target’s SSN. The help desk removed MFA and set a temporary password: Summer2020. The impersonator logged in, reset the password, and gained access to an admin account that could approve BitGo transactions.

The $27 Million Blind Spot

▶ Watch (13:39)

The stolen $80 million was traced through two wallet hops into an automated mixer. The pattern repeated. Over seven months, 40 smaller transactions followed the same double-hop-mixer flow. They totaled $27 million. Combined loss reached $107 million. The attackers had been siphoning funds since before the final big hit.

Cross-Cloud Lateral Movement

▶ Watch (20:50)

Logs showed an AWS IAM user called “secops” had invoked SSM to run commands on the hot wallet server. The organization did not create that user. It was created by a GitHub Action that accessed stored AWS credentials. The Action was triggered by a pull request made with a stolen personal access token. The token came from a password manager. The attacker had logged into the password manager via Entra.

Reconstructing the Entry Point

▶ Watch (30:24)

Seven months earlier, the target developer’s AD audit logs showed five password changes in two days. Password hashes from the NTDS.dit file revealed a pattern: user, help desk, attacker, help desk, user. The attacker called the help desk hours after the user changed his own password. The user never noticed because he thought he fat-fingered it. The attacker learned of the scheduled password reset from emails inside a previously compromised mailbox.

Key Takeaways from the Heist

▶ Watch (40:50)

Meitar offered three lessons. First, cloud-specific attacks need cloud-specific defenses; native tools like SSM and GitHub Actions bypass traditional controls. Second, speed matters; attackers moved from Entra to GitHub to AWS in hours. Third, centralized visibility across all services is required for detection and investigation. The six services involved here should have fed a single pane of glass.

Q&A

How could the company have improved help desk procedures to prevent the initial compromise? Restrict help desk access for privileged users; require a manager to approve credential changes for admins who can approve large transactions. ▶ 43:26

What attacker group is behind this? North Korean groups are the most common, especially for long-duration crypto heists; they have established fake academic identities over months to gain initial access. ▶ 44:48

How did the attacker access the password manager? The developer used a personal 1Password vault accessible via Entra SSO; once the attacker had Entra access, they could click on the password and see it. ▶ 46:19

Notable Quotes

I have removed the MFA from your account and the device. So, everything should be good. You can try to log in now with the password summer 2020 with a capital S. Help desk agent · ▶ 09:40

So the understanding of the scope of the attack has expanded dramatically, right? Yotam Meitar · ▶ 13:42

Key Takeaways

  • Help desk calls remain a low-friction entry point for privileged account compromise.
  • Attackers can operate undetected for months by siphoning small amounts over many transactions.
  • Cloud-native tools like SSM and GitHub Actions enable stealthy lateral movement across services.