LAPSUS$
- ID
- G1004
- Associated names
- DEV-0537, Strawberry Tempest
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.[1][2][3]
Techniques used (43)
- T1003.003 NTDS
- T1003.006 DCSync
- T1005 Data from Local System
- T1068 Exploitation for Privilege Escalation
- T1069.002 Domain Groups
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1087.002 Domain Account
- T1090 Proxy
- T1098.003 Additional Cloud Roles
- T1111 Multi-Factor Authentication Interception
- T1114.003 Email Forwarding Rule
- T1133 External Remote Services
- T1136.003 Cloud Account
- T1199 Trusted Relationship
- T1204 User Execution
- T1213.001 Confluence
- T1213.002 Sharepoint
- T1213.003 Code Repositories
- T1213.005 Messaging Applications
- T1485 Data Destruction
- T1489 Service Stop
- T1531 Account Access Removal
- T1552.008 Chat Messages
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1578.002 Create Cloud Instance
- T1578.003 Delete Cloud Instance
- T1583.003 Virtual Private Server
- T1584.002 DNS Server
- T1586.002 Email Accounts
- T1588.001 Malware
- T1588.002 Tool
- T1589 Gather Victim Identity Information
- T1589.001 Credentials
- T1589.002 Email Addresses
- T1591.002 Business Relationships
- T1591.004 Identify Roles
- T1593.003 Code Repositories
- T1597.002 Purchase Technical Data
- T1598.004 Spearphishing Voice
- T1621 Multi-Factor Authentication Request Generation
- T1684.001 Impersonation