Incident
incident:las_vegas_sands_cyber_attack
Also: LVS cyber-attack, attack on Las Vegas Sands
Destructive February 2014 cyber-attack that compromised Las Vegas Sands networks, stole data, defaced websites, and wiped Windows systems.
Destructive February 2014 cyber-attack that compromised Las Vegas Sands networks, stole data, defaced websites, and wiped Windows systems.
“The cyber-attack on LVS was clearly designed to immobilize and destroy”
“The attack on Las Vegas Sands wiped out almost 75% of the company’s networks and servers”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Sands Bethlehem | Explicit | 37 |
| outgoing | INVOLVES | brute-force password attack | Explicit | 37 |
| outgoing | INVOLVES | two-factor authentication | Explicit | 37 |
| outgoing | INVOLVES | Mimikatz | Explicit | 37 |
| outgoing | INVOLVES | credential dumping | Explicit | 37 |
| outgoing | INVOLVES | lateral movement | Explicit | 37 |
| outgoing | INVOLVES | persistence | Explicit | 37 |
| outgoing | INVOLVES | Data exfiltration | Explicit | 37 |
| outgoing | INVOLVES | wiper virus | Explicit | 37 |
| outgoing | COMPROMISES | Las Vegas Sands | Explicit | 37 |
| outgoing | ATTRIBUTED_TO | Iranian government | Attributed | 37 |
Las Vegas Sands cyber-attack INVOLVES Sands Bethlehem
The cyber-attack began with activity against the Sands Bethlehem network and its internet-facing systems.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“the IT team in the Sands [00:15:00] Bethlehem resort saw some worrying activity on their computer network”
Las Vegas Sands cyber-attack INVOLVES brute-force password attack
The attackers attempted hundreds of password combinations against VPN users in a brute-force password attack.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They tried hundreds and hundreds of password combinations to try to get into this VPN”
Las Vegas Sands cyber-attack INVOLVES two-factor authentication
The Sands security team enabled two-factor authentication for VPN users to prevent the password attack from succeeding.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They enabled two factor authentication for VPN users”
Las Vegas Sands cyber-attack INVOLVES Mimikatz
The attackers used Mimikatz on a web development server to obtain usernames and passwords.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They used a tool called Mimikatz”
“these hackers ran Mimikatz on this web development server”
Las Vegas Sands cyber-attack INVOLVES credential dumping
The attackers harvested usernames and clear-text passwords from the web development server using Mimikatz.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“they were able to see the usernames and passwords of web developers and IT admins for Sands Bethlehem”
Las Vegas Sands cyber-attack INVOLVES lateral movement
After compromising one server, the attackers attempted to move laterally and escalate privileges across the network.
Explicit Confidence 98% · Jack Rhysider EP 37 Details
“you now need to figure out how to laterally move or escalate your privileges”
Las Vegas Sands cyber-attack INVOLVES persistence
The attackers established a persistent connection so they could retain access if the compromised password changed.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“They gave themselves a persistent connection to it in case that password was to change”
Las Vegas Sands cyber-attack INVOLVES Data exfiltration
During the attack, sensitive customer, guest, staff, and gambler data was compressed and downloaded.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“sensitive files were being compressed and downloaded”
“Social security numbers were stolen, drivers license details were stolen”
Las Vegas Sands cyber-attack INVOLVES wiper virus
The attack involved a custom-written Visual Basic wiper code intended to destroy data and spread through the network.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“a wiper code with the goal of destruction”
“This wiper virus was on a mission to infect and spread to as many systems as it could and delete the data”
Las Vegas Sands cyber-attack COMPROMISES Las Vegas Sands
The cyber-attack compromised Las Vegas Sands' networks, servers, and data and caused extensive operational damage.
Explicit Confidence 99% · Jack Rhysider EP 37 Details
“The attack on Las Vegas Sands wiped out almost 75% of the company’s networks and servers”
Las Vegas Sands cyber-attack ATTRIBUTED_TO Iranian government
James Clapper attributed the attack against Las Vegas Sands to Iran; Jack presents this as an official attribution to the Iranian government or military, while noting the broader circumstances and motives were uncertain.
Attributed Confidence 97% · James Clapper EP 37 Details
“2014 saw for the first time destructive cyber-attacks carried out on [00:25:00] US soil by nation state entities marked first by the Iranian attack against the Las Vegas Sands Casino Corporation”
“James Clapper is saying that the people who did it was the Iranian government itself”