D
CyberUnattributed

LAPSUS$

Cybercriminal groupTrackedPending verification

Also known as: DEV-0537, Strawberry Tempest

CyberUNK
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeCybercriminal group
Alternative designationsDEV-0537, Strawberry Tempest
ProliferationOrigin country only
Active since2021At least 2021Med[1]
MITRE ATT&CK IDG1004High[1]
Capabilities
ATT&CK techniques used43ATT&CK v20.1High[1]
Malware and toolsMimikatz1 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorCybercriminal extortion groupMed[1]
TargetsThe group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.Med[1]
Notes
LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Sources
  1. LAPSUS$, Group G1004, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1004)