« All threats

APT groupMITRE G1004

LAPSUS$

Also known as: dev-0537, strawberry tempest

Lapsus$ is a cyber extortion group first observed in late 2021, known for high-profile breaches and data theft campaigns against major global companies rather than traditional ransomware encryption. The group primarily focuses on data exfiltration and public leak threats without encrypting victim systems. Lapsus$ uses a combination of social engineering, SIM swapping, MFA fatigue attacks, and purchasing access from insiders or access brokers to infiltrate corporate networks. Their victim list includes Microsoft, Okta, NVIDIA, Samsung, Uber, and telecom operators, with operations targeting multiple regions worldwide. Once inside, Lapsus$ actors exfiltrate source code, proprietary data, and customer information, often leaking samples to pressure victims into negotiation. The group is known for a brash and public-facing style, communicating directly with followers on Telegram channels and occasionally mocking victims. Several members, including minors, have been arrested in the UK, but the group’s activities have persisted in some form.

Victims in the last 90 days0

Most affected countries

No data yet.

Most affected sectors

No data yet.

Priority mitigations

MITRE ATT&CK mitigations that cover the most techniques used by this group.

  1. User Training (15 techniques covered)
  2. User Account Management (13 techniques covered)
  3. Multi-factor Authentication (9 techniques covered)
  4. Audit (9 techniques covered)
  5. Privileged Account Management (6 techniques covered)
  6. Password Policies (6 techniques covered)
  7. Network Segmentation (4 techniques covered)
  8. Active Directory Configuration (3 techniques covered)

MITRE ATT&CK techniques

T1589 · Gather Victim Identity InformationT1005 · Data from Local SystemT1069.002 · Domain GroupsT1213.001 · ConfluenceT1588.002 · ToolT1485 · Data DestructionT1213.003 · Code RepositoriesT1213.002 · SharepointT1583.003 · Virtual Private ServerT1591.004 · Identify RolesT1090 · ProxyT1087.002 · Domain AccountT1133 · External Remote ServicesT1078 · Valid AccountsT1588.001 · MalwareT1598.004 · Spearphishing VoiceT1204 · User ExecutionT1552.008 · Chat MessagesT1489 · Service StopT1593.003 · Code RepositoriesT1136.003 · Cloud AccountT1114.003 · Email Forwarding RuleT1591.002 · Business RelationshipsT1578.003 · Delete Cloud InstanceT1555.003 · Credentials from Web BrowsersT1531 · Account Access RemovalT1589.001 · CredentialsT1068 · Exploitation for Privilege EscalationT1621 · Multi-Factor Authentication Request GenerationT1098.003 · Additional Cloud RolesT1586.002 · Email AccountsT1213.005 · Messaging ApplicationsT1589.002 · Email AddressesT1584.002 · DNS ServerT1684.001 · ImpersonationT1003.003 · NTDST1555.005 · Password ManagersT1199 · Trusted RelationshipT1597.002 · Purchase Technical DataT1578.002 · Create Cloud InstanceT1078.004 · Cloud AccountsT1111 · Multi-Factor Authentication InterceptionT1003.006 · DCSync

Recent victims

No data yet.

Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.

Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.