LAPSUS$
LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.
- ATT&CK ID
- G1004
- Weather family
- Tempest
- Techniques
- 32
- Tools
- 1
Also tracked as DEV-0537 · Strawberry Tempest
Techniques
Reconnaissance
Gather Victim Identity InformationGather Victim Org InformationSearch Open Websites/DomainsSearch Closed SourcesPhishing for Information
Resource Development
Acquire InfrastructureCompromise InfrastructureCompromise AccountsObtain Capabilities
Initial Access
Valid AccountsExternal Remote ServicesTrusted Relationship
Execution
Persistence
Valid AccountsAccount ManipulationExternal Remote ServicesCreate Account
Privilege Escalation
Exploitation for Privilege EscalationValid AccountsAccount Manipulation
Stealth
Valid AccountsSocial Engineering
Defense Impairment
Modify Cloud Compute Infrastructure
Credential Access
OS Credential DumpingMulti-Factor Authentication InterceptionUnsecured CredentialsCredentials from Password StoresMulti-Factor Authentication Request Generation
Discovery
Permission Groups DiscoveryAccount Discovery
Collection
Data from Local SystemEmail CollectionData from Information Repositories
Command and Control
Impact
Data DestructionService StopAccount Access Removal
Software
Mimikatz