LastPass - Dev Env Breach → Source Code Recon → DevOps Home PC (Plex Exploit) → Keylogger → AWS S3 Vault Backup Exfil
A two-stage attack first compromised LastPass's development environment, then used the stolen technical knowledge to target a specific DevOps engineer, one of only four people with access to production decryption keys. The attacker exploited a years-old unpatched vulnerability in Plex Media Server on the engineer's personal home computer to install a keylogger, captured the master password, unlocked the engineer's LastPass corporate vault, and used the cloud credentials inside to exfiltrate encrypted customer vault backups from AWS S3. The entire chain required no zero-days in LastPass's production infrastructure.
A LastPass software developer's endpoint was compromised via a third-party software package. The attacker used this foothold to access the developer's credentials and the shared development environment, exfiltrating source code, technical documentation, internal secrets, and some customer metadata. LastPass disclosed this breach in August 2022, describing it as a development environment incident with no customer data or vault content accessed. What wasn't known at the time: the stolen technical documentation would be used to plan Stage 2.
Customer impact at Stage 1: None disclosed - no production access, no vault data
Strategic value to attacker: Infrastructure topology, S3 bucket names, backup key architecture, target identity (DevOps engineer)
Using the documentation stolen in Stage 1, the attacker understood exactly how LastPass's production backup encryption worked: a small set of DevOps engineers held decryption keys for the production S3 backup environment. Only four employees had access. The attacker identified one of these four as the target for Stage 2 and chose home infrastructure as the attack surface because personal endpoints are outside corporate MDM and EDR coverage.
Attack surface chosen: Personal home computer - outside corporate MDM, EDR, and monitoring
Intelligence source: Stage 1 stolen technical documentation and internal runbooks
The targeted DevOps engineer ran Plex Media Server on their personal home computer. The attacker exploited a known vulnerability in Plex that had been publicly disclosed years prior and had a patch available, but the engineer's home installation was unpatched. Plex itself disclosed separately that it had been notified of this exploitation and confirmed the CVE was over two years old with a patch available. The exploit provided remote code execution on the home machine.
Vulnerability age: Over 2 years old with patch available at time of exploitation
Attack surface: Personal home computer - no corporate EDR, no MDM, no monitoring
Result: Remote code execution on the DevOps engineer's home machine
Using the RCE foothold, the attacker installed a keylogger on the DevOps engineer's home PC. When the engineer next signed in to their LastPass corporate vault, the master password was captured in plaintext. LastPass said the keylogger captured the master password as it was entered, after the employee authenticated with MFA, which gave the attacker access to the engineer's corporate vault.
MFA: The employee completed MFA; the keylogger captured the master password typed afterwards. LastPass has not said how the attacker's access got around MFA.
What was captured: Master password for the DevOps engineer's LastPass corporate vault
The attacker used the captured master password to decrypt the DevOps engineer's LastPass vault. Inside were the credentials the engineer used day-to-day: AWS IAM access keys, cloud infrastructure credentials, and the decryption keys for the LastPass production backup environment stored in S3. The vault effectively contained the keys to the kingdom. By targeting the one person whose vault was both accessible from a personal device and contained production credentials, the attacker bypassed all of LastPass's production security controls in a single step.
Irony: A password manager's own vault was the attack vector against its production infrastructure
Architectural failure: Production backup keys reachable from a vault opened on a home computer
Using the AWS credentials from the decrypted vault, the attacker accessed LastPass's production S3 backup buckets and exfiltrated a copy of all encrypted customer vault backups. The backup files also contained unencrypted data: website URLs in the vaults, and customer account metadata including end-user names, email addresses, billing addresses, telephone numbers and IP addresses. Website usernames and passwords were encrypted. A separate backup of the MFA/federation database held users' MFA seeds; it was encrypted, but its decryption key was among the stolen secrets. The encrypted vault data itself is protected by each customer's master password, but weak master passwords remain vulnerable to offline brute-force attacks against the exfiltrated data.
Unencrypted data also taken: Website URLs; end-user names, emails, billing addresses and IP addresses; MFA database (encrypted, key stolen)
Ongoing risk: Offline brute-force attacks against encrypted vaults using weak master passwords
Also taken: API integration secrets, multi-factor authentication seeds, customer keys