FORENSIA

THREAT_ACTOR · G1004

LAPSUS$

Also known as: LAPSUS$, DEV-0537, Strawberry Tempest

Profile

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.

MITRE ATT&CK ↗

Techniques

43 ATT&CK techniques attributed to this actor.

T1003.003 NTDST1003.006 DCSyncT1005 Data from Local SystemT1068 Exploitation for Privilege EscalationT1069.002 Domain GroupsT1078 Valid AccountsT1078.004 Cloud AccountsT1087.002 Domain AccountT1090 ProxyT1098.003 Additional Cloud RolesT1111 Multi-Factor Authentication InterceptionT1114.003 Email Forwarding RuleT1133 External Remote ServicesT1136.003 Cloud AccountT1199 Trusted RelationshipT1204 User ExecutionT1213.001 ConfluenceT1213.002 SharepointT1213.003 Code RepositoriesT1213.005 Messaging ApplicationsT1485 Data DestructionT1489 Service StopT1531 Account Access RemovalT1552.008 Chat MessagesT1555.003 Credentials from Web BrowsersT1555.005 Password ManagersT1578.002 Create Cloud InstanceT1578.003 Delete Cloud InstanceT1583.003 Virtual Private ServerT1584.002 DNS ServerT1586.002 Email AccountsT1588.001 MalwareT1588.002 ToolT1589 Gather Victim Identity InformationT1589.001 CredentialsT1589.002 Email AddressesT1591.002 Business RelationshipsT1591.004 Identify RolesT1593.003 Code RepositoriesT1597.002 Purchase Technical DataT1598.004 Spearphishing VoiceT1621 Multi-Factor Authentication Request GenerationT1684.001 Impersonation

Software

1 malware/tools attributed to this actor.

Mimikatz

Related corpus activity

8,940 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to LAPSUS$.

IndicatorTypeFamilySevSrc
cve-2021-4045cve—851
cve-2026-0740cve—851
cve-2025-11837cve—852
cve-2023-44976cveransomware852
cve-2026-4368cveransomware851
cve-2026-1969cve—851
cve-2025-0921cve—852
cve-2013-3307cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-22658cve—852
cve-2025-34117cve—851
cve-2013-7471cve—851
cve-2021-29441cve—851
cve-2025-23304cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2021-27076cve—851
cve-2025-68670cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2020-17456cve—851
cve-2020-22653cve—852
cve-2025-2492cve—852
cve-2016-5681cve—852
cve-2022-47945cve—851
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2026-3844cve—851

Showing the top 30 by severity of 8,940.