LAPSUS$ has added the global admin role to accounts they have created in the targeted organization's cloud instances.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Azure AD,Office 365,IaaS,Google Workspace,SaaS|T1136.003|Cloud Account|

LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Azure AD,Office 365,SaaS,IaaS,Google Workspace|T1078.004|Cloud Accounts|

LAPSUS$ has used compromised credentials to access cloud assets within a target organization.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|IaaS|T1578.003|Delete Cloud Instance|

LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|IaaS|T1578.002|Create Cloud Instance|

LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.(Citation: MSTIC DEV-0537 Mar 2022) |
|mitre-attack|enterprise-attack|PRE|T1583.003|Virtual Private Server|

LAPSUS$ has used VPS hosting providers for infrastructure.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1589|Gather Victim Identity Information|

LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,IaaS,Containers|T1204|User Execution|

LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing