MITRE ATT&CKgroup
G1004 LAPSUS$
- Domain
- enterprise, mobile
- Aliases
- DEV-0537, Strawberry Tempest
- Version
- 2.1
- Created
- 2022-06-09
Description
LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.
Related
Uses · MITRE ATT&CK (45)
- T1684.001 Impersonation sub-technique
- T1213.005 Messaging Applications sub-technique
- T1598.004 Spearphishing Voice sub-technique
- T1552.008 Chat Messages sub-technique
- T1593.003 Code Repositories sub-technique
- T1621 Multi-Factor Authentication Request Generation technique
- T1213.003 Code Repositories sub-technique
- T1555.005 Password Managers sub-technique
- T1589 Gather Victim Identity Information technique
- T1589.001 Credentials sub-technique
- T1589.002 Email Addresses sub-technique
- T1591.002 Business Relationships sub-technique
- T1591.004 Identify Roles sub-technique
- T1597.002 Purchase Technical Data sub-technique
- T1583.003 Virtual Private Server sub-technique
- T1584.002 DNS Server sub-technique
- T1586.002 Email Accounts sub-technique
- T1588.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1578.003 Delete Cloud Instance sub-technique
- T1578.002 Create Cloud Instance sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1069.002 Domain Groups sub-technique
- T1087.002 Domain Account sub-technique
- T1114.003 Email Forwarding Rule sub-technique
- T1213.001 Confluence sub-technique
- T1213.002 Sharepoint sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1003.003 NTDS sub-technique
- T1003.006 DCSync sub-technique
References
- https://www.bbc.com/news/technology-60953527 BBC LAPSUS Apr 2022
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ MSTIC DEV-0537 Mar 2022
- https://unit42.paloaltonetworks.com/lapsus-group/ UNIT 42 LAPSUS Mar 2022