LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing

LAPSUS$ to take control of an authenticated system.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|

LAPSUS$ has used Windows built-in tool

LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1069.002|Domain Groups|

LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|SaaS|T1213.003|Code Repositories|

LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1213.002|Sharepoint|