lapsus$ Ransomware
Tracked since Mar 1, 2026
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
In MITRE ATT&CK MITRE ATT&CK
Group profile: LAPSUS$ (G1004)
Lapsus$ is an internationally composed data extortion group most active from mid-2021 through 2022, executing high-profile breaches against Microsoft, Nvidia, Samsung, Okta, and Uber by stealing source code and threatening leaks rather than encrypting files; several members — predominantly teenagers — were arrested in the UK.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1078.004 Valid Accounts: Cloud AccountsT1133 External Remote ServicesT1199 Trusted Relationship Execution
T1204 User Execution Persistence
T1078 Valid AccountsT1078.004 Valid Accounts: Cloud AccountsT1098.003 Account Manipulation: Additional Cloud RolesT1133 External Remote ServicesT1136.003 Create Account: Cloud Account Privilege Escalation
T1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.004 Valid Accounts: Cloud AccountsT1098.003 Account Manipulation: Additional Cloud Roles Stealth
T1078 Valid AccountsT1078.004 Valid Accounts: Cloud AccountsT1684.001 Social Engineering: Impersonation Credential Access
T1003.003 OS Credential Dumping: NTDST1003.006 OS Credential Dumping: DCSyncT1111 Multi-Factor Authentication InterceptionT1552.008 Unsecured Credentials: Chat MessagesT1555.003 Credentials from Password Stores: Credentials from Web BrowsersT1555.005 Credentials from Password Stores: Password ManagersT1621 Multi-Factor Authentication Request Generation Discovery
T1069.002 Permission Groups Discovery: Domain GroupsT1087.002 Account Discovery: Domain Account Collection
T1005 Data from Local SystemT1114.003 Email Collection: Email Forwarding RuleT1213.001 Data from Information Repositories: ConfluenceT1213.002 Data from Information Repositories: SharepointT1213.003 Data from Information Repositories: Code RepositoriesT1213.005 Data from Information Repositories: Messaging Applications Command and Control
T1090 Proxy Impact
T1485 Data DestructionT1489 Service StopT1531 Account Access Removal Resource Development
T1583.003 Acquire Infrastructure: Virtual Private ServerT1584.002 Compromise Infrastructure: DNS ServerT1586.002 Compromise Accounts: Email AccountsT1588.001 Obtain Capabilities: MalwareT1588.002 Obtain Capabilities: Tool Reconnaissance
T1589 Gather Victim Identity InformationT1589.001 Gather Victim Identity Information: CredentialsT1589.002 Gather Victim Identity Information: Email AddressesT1591.002 Gather Victim Org Information: Business RelationshipsT1591.004 Gather Victim Org Information: Identify RolesT1593.003 Search Open Websites/Domains: Code RepositoriesT1597.002 Search Closed Sources: Purchase Technical DataT1598.004 Phishing for Information: Spearphishing Voice Defense Impairment
T1578.002 Modify Cloud Compute Infrastructure: Create Cloud InstanceT1578.003 Modify Cloud Compute Infrastructure: Delete Cloud Instance Observed tools
Credential Theft
Mimikatz
Discovery Enum
ADExplorer
LOLBAS
NTDS Utility (ntdsutil)
RMM-Tools
AnyDesk
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live