{
  "id": "lapsuss",
  "name": "LAPSUS$",
  "aliases": [
    "DEV-0537",
    "Strawberry Tempest"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Cybercriminal extortion group",
      "src": [
        "mitre-g1004"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2021,
      "src": [
        "mitre-g1004"
      ],
      "conf": "medium",
      "note": "At least 2021"
    },
    {
      "k": "attack_id",
      "v": "G1004",
      "src": [
        "mitre-g1004"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.",
      "src": [
        "mitre-g1004"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 43,
      "src": [
        "mitre-g1004"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Mimikatz",
      "src": [
        "mitre-g1004"
      ],
      "conf": "high",
      "note": "1 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1004)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/lapsuss.html",
  "sources": {
    "mitre-g1004": {
      "title": "LAPSUS$, Group G1004",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1004/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}