LAPSUS$

Also tracked as DEV-0537, Strawberry Tempest

LAPSUS$ is an extortion focused group that relied on social engineering, SIM swapping, and insider recruitment to breach technology and telecom firms. Once inside it abused cloud admin access to steal source code and data. In some cases it destroyed cloud resources to pressure victims.

Cloud tradecraft

• Uses compromised credentials and session tokens to access cloud tenants
• Creates global admin accounts and adds admin cloud roles for persistence
• Spams MFA prompts hoping a victim approves one
• Abuses Okta and Azure AD trust to reach target organizations
• Creates and deletes cloud virtual machines during intrusions

MITRE ATT&CK techniques

References

• MITRE ATT&CK: LAPSUS$ (G1004)
• DEV-0537 criminal actor targeting organizations for data exfiltration and destruction
• Review of the Attacks Associated with LAPSUS$ and Related Threat Groups