LAPSUS

G10040 reports from 0 vendors

An actor group conducting large-scale social engineering and extortion campaign against multiple organizations with some seeing evidence of destructive elements.

Vendor aliases (5)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	LAPSUS$
OSINT	DEV-0537
OSINT	SLIPPY SPIDER
OSINT	Strawberry Tempest
OSINT	UNC3661

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names LAPSUS, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to LAPSUS. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (7)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

attack.mitre.orghttps://attack.mitre.org/groups/G1004
learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/lapsus-group/
bbc.comhttps://www.bbc.com/news/technology-60953527
microsoft.comhttps://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
blog.checkpoint.comhttps://blog.checkpoint.com/2022/03/07/lapsus-ransomware-gang-uses-stolen-source-code-to-disguise-malware-files-as-trustworthy-check-point-customers-remain-protected/
crowdstrike.comhttps://www.crowdstrike.com/adversaries/slippy-spider/