• The LAPSUS$ group breached a number of high profile companies with a view to extorting them.
• This week a court in the UK found that two teenagers had committed a number of crimes while operating under the LAPSUS$ banner.
• The pair will be sentenced at a later date.

At start of 2022 a cybercrime operation rose in prominence under the moniker of LAPSUS$. The hacking collective as we’ll refer to them as, was able to breach a number of high profile companies including Okta, Rockstar Games, Uber, and NVIDIA.

This week at the Southwark Crown Court in England, two teens aged 17 and 18 were found to have committed a litany of crimes.

The 18-year old Arion Kurtaj was determined to have committed 12 offenses including computer intrusion, blackmail and fraud. The 17-year old who cannot be identified due to their age was found to have committed fraud, blackmail and an unauthorised act to impair operation of a computer as reported by The Register.

Interestingly, the jury was told not to determine whether Kurtaj is guilty or not guilty as he is autistic and was earlier found to be unfit to stand trial. Rather, the jury was tasked with determining whether the teen committed the crimes or not.

According to AP News, prosecutors in the case said the two teenagers were key players in the crimes committed by LAPSUS$. This includes breaching Rockstar games and threatening to leak the source code of a Grand Theft Auto sequel online.

While both defendants are young, the crimes they are accused of are incredibly serious and lawmakers appear to be treating them with that gravity. Lead barrister for the prosecution said the pair as well as their other conspirators showed a “juvenile desire to stick two fingers up to those they are attacking”.

Per the BBC, Kurtaj has been remanded in custody while the 17-year old has bail.

Despite being teenagers and consisting largely of younger individuals, LAPSUS$ prompted the Cybersecurity and Infrastructure Security Agency in the US to review attacks the collective perpetrated.

One of the findings from that review was that teens are a bit of a threat to security given that the punishments are often less severe than those of their adult counterparts.

“The juvenile status of certain threat actors can limit federal law enforcement’s role and yield lighter penalties under their home countries’ legal frameworks. Less severe consequences may not adequately deter juveniles and few cyber-specific intervention programs exist that can help divert potential offenders to legitimate cybersecurity activities,” the agency noted.