LAPSUS$ has searched public code repositories for exposed credentials.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1597.002|Purchase Technical Data|

LAPSUS$ has purchased credentials and session tokens from criminal underground forums.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1589.001|Credentials|

LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

LAPSUS$ has obtained tools such as AD Explorer inspection software for their operations.(Citation: MSTIC DEV-0537 Mar 2022)|