LAPSUS$

Overview

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.

Naming & attribution

LAPSUS$ is tracked under 3 names across the industry. It uses 43 documented ATT&CK techniques — more than 78% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1213.001 Confluence — used by 1 of 174 groups
• T1552.008 Chat Messages — used by 1 of 174 groups
• T1597.002 Purchase Technical Data — used by 1 of 174 groups
• T1136.003 Cloud Account — used by 2 of 174 groups
• T1204 User Execution — used by 2 of 174 groups
• T1531 Account Access Removal — used by 2 of 174 groups
• T1578.002 Create Cloud Instance — used by 2 of 174 groups
• T1578.003 Delete Cloud Instance — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Scattered Spider — 21 shared techniques (24% overlap)
• VOID MANTICORE Iran — 13 shared techniques (14% overlap)
• Sandworm Team Russia — 13 shared techniques (12% overlap)
• Volt Typhoon China — 13 shared techniques (12% overlap)
• HAFNIUM China — 9 shared techniques (12% overlap)
• APT28 Russia — 13 shared techniques (11% overlap)

Capabilities

• Destructive / data-wiping operations — ATT&CK T1485

TTPs — 43 techniques across 13 tactics

Tools & malware (1)

Mimikatz

Reporting (3)

• How Microsoft names threat actors — Microsoft
• LAPSUS: Two UK Teenagers Charged with Hacking for Gang — BBC
• DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction — MSTIC, DART, M365 Defender