Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · LAPSUS · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

LAPSUS

  • LAPSUS$
  • DEV-0537
  • SLIPPY SPIDER
  • Strawberry Tempest
  • UNC3661
  • Lapsus

MITRE G1004 ↗

LAPSUS — ATT&CK roseLA

attack rose · 43 techniques across 13 tactics

Last 30 days

last seen 11 d ago
dispatches3
victims0
CVEs seen0

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2023-2163
  2. —1 mo agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

An actor group conducting large-scale social engineering and extortion campaign against multiple organizations with some seeing evidence of destructive elements.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

43 techniques · 13 of 15 tactics

  1. Reconnaissance

    8 techniques

  2. Resource development

    5 techniques

  3. Initial access

    1 technique

  4. Execution

    1 technique

  5. Persistence

    3 techniques

  6. Privilege escalation

    1 technique

  7. Stealth

    3 techniques

  8. Defense impairment

    2 techniques

  9. Credential access

    7 techniques

  10. Discovery

    2 techniques

  11. Collection

    6 techniques

  12. Command and control

    1 technique

  13. Impact

    3 techniques

select a technique

Arsenal

1 tools
Tools
Tools · 1ATT&CK
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs LAPSUS is cited as using in a campaign

none on KEV
  1. CVE-2023-21632026-10-17
    1. “Terminal output published by the group that demonstrates a local privilege escalation exploit (CVE-2023-2163) with access to /etc/shadow.”

      cited as used in a campaign · named nearby · source: levelblue.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022LAPSUS$: Recent techniques, tactics and proceduresnccgroup ↗

Take it with you

keyless · no signup

References

7 sources
  1. 1.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targe…
  2. 2.blog.checkpoint.com/2022/03/07/lapsus-ransomware-gang-uses-stolen-source-c…
  3. 3.crowdstrike.com/adversaries/slippy-spider
  4. 4.attack.mitre.org/groups/G1004
  5. 5.bbc.com/news/technology-60953527
  6. 6.learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-th…
  7. 7.unit42.paloaltonetworks.com/lapsus-group

Track LAPSUS on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.