defection.io

group

LAPSUS$ G1004

Created: 9 June 2022
Last modified: 31 July 2026
Aliases: LAPSUS$ · DEV-0537 · Strawberry Tempest

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.[1][2][3]

TechniquesTop 21%

TacticsTop 15%

Tool or malwareBottom 23%

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

group

LAPSUS$ G1004

Created: 9 June 2022
Last modified: 31 July 2026
Aliases: LAPSUS$ · DEV-0537 · Strawberry Tempest

TechniquesTop 21%

TacticsTop 15%

Tool or malwareBottom 23%

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

LAPSUS$ MITRE reference G1004

NTDS T1003.003 ↗

LAPSUS$ has used Windows built-in tool ntdsutil to extract the Active Directory (AD) database.4

Credential Access30 detection rules

DCSync T1003.006 ↗

LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.5

Credential Access10 detection rules

Data from Local System T1005 ↗

LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.6

Collection22 detection rules

Exploitation for Privilege Escalation T1068 ↗

LAPSUS$ has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.7

Privilege Escalation88 detection rules

Domain Groups T1069.002 ↗

LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.8

Discovery36 detection rules

Valid Accounts T1078 ↗

LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.9 10

Initial Access · Persistence · Privilege Escalation · Stealth97 detection rules

Standing G1004

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques43Top 21%

79th percentile · 79% of 176 ATT&CK groups have this many Enterprise techniques or fewer.

Tactics13Top 15%

85th percentile · 85% of 176 ATT&CK groups have this many tactics spanned or fewer.

Tool or malware1Bottom 23%

23rd percentile · 77% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique4medBottom 11%

11th percentile · 89% of 176 ATT&CK groups have more detection rules per technique.

Tests / technique0medBottom 16%

16th percentile · 84% of 176 ATT&CK groups have more atomic tests per technique.

Data comps / technique3med65% tie · 12 values

65% of the population shares a single value across only 12 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique2med43% tie · 11 values

43% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this group’s 43 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 339Splunk ESCU (cumulative) · 364