Home / Threat actors / LAPSUS$

LAPSUS$ G1004

🔔 Create alert

Also known as: DEV-0537, Strawberry Tempest

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

51

Techniques

1

Malware and tools

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.

Ransomware operations linked to this group ransomware.live

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance

T1589 Gather Victim Identity Information T1589.001 Credentials T1589.002 Email Addresses T1591.002 Business Relationships T1591.004 Identify Roles T1593.003 Code Repositories T1597.002 Purchase Technical Data T1598.004 Spearphishing Voice

Resource Development

T1583.003 Virtual Private Server T1584.002 DNS Server T1586.002 Email Accounts T1588.001 Malware T1588.002 Tool

Initial Access

T1078 Valid Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1199 Trusted Relationship

Execution

T1204 User Execution

Persistence

T1078 Valid Accounts T1078.004 Cloud Accounts T1098.003 Additional Cloud Roles T1133 External Remote Services T1136.003 Cloud Account

Privilege Escalation

T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.004 Cloud Accounts T1098.003 Additional Cloud Roles

Stealth

T1078 Valid Accounts T1078.004 Cloud Accounts T1684.001 Impersonation

Defense Impairment

T1578.002 Create Cloud Instance T1578.003 Delete Cloud Instance

Credential Access

T1003.003 NTDS T1003.006 DCSync T1111 Multi-Factor Authentication Interception T1552.008 Chat Messages T1555.003 Credentials from Web Browsers T1555.005 Password Managers T1621 Multi-Factor Authentication Request Generation

Discovery

T1069.002 Domain Groups T1087.002 Domain Account

Collection

T1005 Data from Local System T1114.003 Email Forwarding Rule T1213.001 Confluence T1213.002 Sharepoint T1213.003 Code Repositories T1213.005 Messaging Applications

Command and Control

T1090 Proxy

Impact

T1485 Data Destruction T1489 Service Stop T1531 Account Access Removal

Malware and tools

MimikatzToolS0002

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.