LAPSUS$
Also known as: DEV-0537, Strawberry Tempest
LAPSUS$ showed how far identity attacks alone can go. Without ransomware, it breached major companies through SIM swapping, MFA fatigue, buying access from insiders and abusing support providers, then stole and leaked data and sometimes deleted it. Its methods prompted a US Cyber Safety Review Board investigation.
- Public attribution
- A cybercriminal extortion group (MITRE ATT&CK); Microsoft reported it first targeted organisations in the United Kingdom and South America.
- Active since
- Around 2021
- Targets
- Technology and telecommunications companies
- Government, healthcare, media and higher education
Status: Several alleged members were arrested in the UK and Brazil in 2022 (reported).
Notable campaigns
2022Breaches of large technology companies
High-profile intrusions and data leaks, including at Microsoft, which published an analysis of the group's methods in March 2022.
2023Cyber Safety Review Board report
The US CSRB reviewed attacks associated with Lapsus$ and related groups and recommended moving away from SMS-based MFA.
Signature ATT&CK techniques
- T1451SIM Card Swap
- T1621Multi-Factor Authentication Request Generation
- T1598.004Phishing for Information: Spearphishing Voice
- T1078.004Valid Accounts: Cloud Accounts
- T1199Trusted Relationship
- T1213.002Data from Information Repositories: Sharepoint
- T1485Data Destruction
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Replace SMS and push-approval MFA with phishing-resistant methods, and enable number matching where push remains.
- Monitor for insider recruitment and protect support and contractor accounts as carefully as staff accounts.
- Limit what support providers can reach and log their sessions.
- Keep incident response communications on a channel the attacker cannot join.