LAPSUS$ - G1004

Created: 2022-06-09T19:14:31.327Z

Modified: 2023-04-11T00:01:29.232Z

Contributors: David Hughes, BT Security,Matt Brenton, Zurich Insurance Group,Flavio Costa, Cisco

Aliases

LAPSUS$,DEV-0537

Description

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.(Citation: BBC LAPSUS Apr 2022)(Citation: MSTIC DEV-0537 Mar 2022)(Citation: UNIT 42 LAPSUS Mar 2022)

Techniques Used

LAPSUS$ has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

LAPSUS$ has payed employees, suppliers, and business partners of target organizations for credentials.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Windows,Office 365,Linux,macOS,IaaS,SaaS,Azure AD,Google Workspace|T1621|Multi-Factor Authentication Request Generation|

LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|