RansomwareMITRE G1004
LAPSUS
Also known as LAPSUS$, DEV-0537, SLIPPY SPIDER, Strawberry Tempest, UNC3661
0mentions, 7 days
0mentions, 30 days
0victims posted, 30 days
nonelast mentioned
An actor group conducting large-scale social engineering and extortion campaign against multiple organizations with some seeing evidence of destructive elements.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1003.003 NTDST1003.006 DCSyncT1005 Data from Local SystemT1068 Exploitation for Privilege EscalationT1069.002 Domain GroupsT1078 Valid AccountsT1078.004 Cloud AccountsT1087.002 Domain AccountT1090 ProxyT1098.003 Additional Cloud RolesT1111 Multi-Factor Authentication InterceptionT1114.003 Email Forwarding RuleT1133 External Remote ServicesT1136.003 Cloud AccountT1199 Trusted RelationshipT1204 User ExecutionT1213.001 ConfluenceT1213.002 SharepointT1213.003 Code RepositoriesT1213.005 Messaging ApplicationsT1451 SIM Card SwapT1485 Data DestructionT1489 Service StopT1531 Account Access RemovalT1552.008 Chat MessagesT1555.003 Credentials from Web BrowsersT1555.005 Password ManagersT1578.002 Create Cloud InstanceT1578.003 Delete Cloud InstanceT1583.003 Virtual Private ServerT1584.002 DNS ServerT1586.002 Email AccountsT1588.001 MalwareT1588.002 ToolT1589 Gather Victim Identity InformationT1589.001 CredentialsT1589.002 Email AddressesT1591.002 Business RelationshipsT1591.004 Identify RolesT1593.003 Code RepositoriesT1597.002 Purchase Technical DataT1598.004 Spearphishing VoiceT1621 Multi-Factor Authentication Request GenerationT1684.001 Impersonation
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
- https://blog.checkpoint.com/2022/03/07/lapsus-ransomware-gang-uses-stolen-source-code-to-disguise-malware-files-as-trustworthy-check-point-customers-remain-protected/
- https://www.crowdstrike.com/adversaries/slippy-spider/
- https://attack.mitre.org/groups/G1004
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
- https://unit42.paloaltonetworks.com/lapsus-group/
- https://www.bbc.com/news/technology-60953527
- https://www.ransomlook.io/group/lapsus%24
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.