Case Study: a higher-education institution removes Lapsus$ threat actor with NCC Group incident response

a higher-education institution removes Lapsus$ threat actor and restores operations with NCC Group

NCC Group was engaged by a higher-education institution after it discovered servers powered off and a staff member locked out of their account. The challenge was a criminal threat actor with a high-privilege foothold, compounded by the loss of key evidence as the affected user's laptop had been wiped before the investigation began.

The solution from NCC Group involved attributing the attack to the Lapsus$ group and using their known TTPs to guide the response. They deployed an EDR solution for containment and forensic analysis, tracked the actor's movement, and guided a full eradication. As a result, NCC Group successfully removed the threat actor from the environment, swiftly restoring operations and improving the client's security posture, subsequently becoming a trusted advisor and rolling out EDR across the entire estate.