Início / Grupos de ameaça / LAPSUS$

LAPSUS$ G1004

🔔 Criar alerta

Também conhecido como: DEV-0537, Strawberry Tempest

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

51

Técnicas

1

Malwares e ferramentas

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.

Operações de ransomware ligadas a este grupo ransomware.live

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Reconhecimento

T1589 Gather Victim Identity Information T1589.001 Credentials T1589.002 Email Addresses T1591.002 Business Relationships T1591.004 Identify Roles T1593.003 Code Repositories T1597.002 Purchase Technical Data T1598.004 Spearphishing Voice

Desenvolvimento de recursos

T1583.003 Virtual Private Server T1584.002 DNS Server T1586.002 Email Accounts T1588.001 Malware T1588.002 Tool

Acesso inicial

T1078 Valid Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1199 Trusted Relationship

Execução

T1204 User Execution

Persistência

T1078 Valid Accounts T1078.004 Cloud Accounts T1098.003 Additional Cloud Roles T1133 External Remote Services T1136.003 Cloud Account

Escalada de privilégios

T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1078.004 Cloud Accounts T1098.003 Additional Cloud Roles

Furtividade

T1078 Valid Accounts T1078.004 Cloud Accounts T1684.001 Impersonation

Comprometimento de defesas

T1578.002 Create Cloud Instance T1578.003 Delete Cloud Instance

Acesso a credenciais

T1003.003 NTDS T1003.006 DCSync T1111 Multi-Factor Authentication Interception T1552.008 Chat Messages T1555.003 Credentials from Web Browsers T1555.005 Password Managers T1621 Multi-Factor Authentication Request Generation

Descoberta

T1069.002 Domain Groups T1087.002 Domain Account

Coleta

T1005 Data from Local System T1114.003 Email Forwarding Rule T1213.001 Confluence T1213.002 Sharepoint T1213.003 Code Repositories T1213.005 Messaging Applications

Comando e controle

T1090 Proxy

Impacto

T1485 Data Destruction T1489 Service Stop T1531 Account Access Removal

Malwares e ferramentas

MimikatzFerramentaS0002

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.