Do you use LastPass?

LastPass recently revealed more details of the second malware attack targeting its infrastructure. It also disclosed the company’s actions to prevent similar attacks in the future. By learning more about the attack, business owners can strengthen their own security weaknesses.


There Were Two Incidents

The threat actor ended the original attack on Aug. 12, 2022. A second attack occurred from Aug. 12, 2022, to Oct. 26, 2022. The two incidents were not seen as related until LastPass began investigating the second attack. Simply put, the threat actor needed information from the second attack to use the data gathered in the first attack.

More Specifics

1. Some LastPass credentials that the threat actor stole in the first attack were encrypted. They did not have access to the decryption keys, which were only available in a handful of places.

2. To access those keys, the second attack targeted a DevOps engineer with access to the decryption keys. The threat actor targeted the engineer’s home computer using a vulnerable third-party media package and a keylogger. This provided access to the engineer’s corporate vault at LastPass.

3. With that access, the threat actor exported the vault entries and shared folder content, including encrypted content and decryption keys.

What Steps LastPass Has Taken

LastPass has taken several notable steps to prevent similar incidents in the future, including:

  • Improving the DevOps engineer’s home security
  • Investigating resources with forensic imaging
  • Rotating credentials the threat actor likely had access to
  • Revoking and then re-issuing certificates the threat actor likely obtained
  • Adding logging and alerting in cloud storage
  • Updating IAM users and keys, including deleting unnecessary users


My perspective

Malware like that used in the LastPass attacks is a growing threat to consumers and businesses. Business owners need to be aware of the dangers posed by this malware, especially combined with the appeal of credit card information. With strong security measures, businesses can protect critical operational data and customer information. Some best practices include monitoring to check for unexpected purchases and canceling affected cards. Businesses should also set up other safeguards. Overall, businesses need to be proactive and informed. This can prevent malware infections and minimize their effects.


"Life is a succession of lessons which must be lived
to be understood." -Ralph Waldo Emerson


By Denis Wilson

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT Support

Thanks for reading this post. I always take into mind that your time and attention are precious. And these posts need to be timely, to the point, and short. For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. You can also find me on LinkedIn, YouTube, and Facebook

I am also a published author and speaker on cloud computing, work-from-anywhere, and cybersecurity. I work extensively with business and professional associations to provide small business technology education programs.


Contact me if you have any questions about the subject.
I'd be happy to spend 15 minutes discussing it with you.