LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.123
- BBC LAPSUS Apr 2022
- MSTIC DEV-0537 Mar 2022
- UNIT 42 LAPSUS Mar 2022
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | LAPSUS$ | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DEV-0537 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Strawberry Tempest | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1485 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.004 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.004 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.008 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1489 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1578.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1531 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1621 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.006 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.005 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.005 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1597.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1578.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1111 | 2022 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.003 | NTDS | — |
| T1003.006 | DCSync | — |
| T1005 | Data from Local System | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1069.002 | Domain Groups | — |
| T1078 | Valid Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1098.003 | Additional Cloud Roles | — |
| T1111 | Multi-Factor Authentication Interception | — |
| T1114.003 | Email Forwarding Rule | — |
| T1133 | External Remote Services | — |
| T1136.003 | Cloud Account | — |
| T1199 | Trusted Relationship | — |
| T1204 | User Execution | — |
| T1213.001 | Confluence | — |
| T1213.002 | Sharepoint | — |
| T1213.003 | Code Repositories | — |
| T1213.005 | Messaging Applications | — |
| T1485 | Data Destruction | — |
| T1489 | Service Stop | — |
| T1531 | Account Access Removal | — |
| T1552.008 | Chat Messages | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1555.005 | Password Managers | — |
| T1578.002 | Create Cloud Instance | — |
| T1578.003 | Delete Cloud Instance | — |
| T1583.003 | Virtual Private Server | — |
| T1584.002 | DNS Server | — |
| T1586.002 | Email Accounts | — |
| T1588.001 | Malware | — |
| T1588.002 | Tool | — |
| T1589 | Gather Victim Identity Information | — |
| T1589.001 | Credentials | — |
| T1589.002 | Email Addresses | — |
| T1591.002 | Business Relationships | — |
| T1591.004 | Identify Roles | — |
| T1593.003 | Code Repositories | — |
| T1597.002 | Purchase Technical Data | — |
| T1598.004 | Spearphishing Voice | — |
| T1621 | Multi-Factor Authentication Request Generation | — |
| T1684.001 | Impersonation | — |
Aliases
DEV-0537 · LAPSUS$ · Strawberry Tempest
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.