LAPSUS$
IntrusionSet · ATTACK:enterprise:G1004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1004",
"title": "LAPSUS$",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--d8bc9788-4f7d-41a9-9e9d-ee1ea18a8cf7",
"external_id": "G1004",
"domain": "enterprise",
"created": "2022-06-09T19:14:31.327Z",
"modified": "2026-07-31T20:48:49.009Z",
"version": "2.1",
"aliases": [
"LAPSUS$",
"DEV-0537",
"Strawberry Tempest"
],
"tactics": [
],
"source_references": [
{
"source_name": "Strawberry Tempest"
},
{
"source_name": "DEV-0537"
},
{
"source_name": "BBC LAPSUS Apr 2022",
"url": "https://www.bbc.com/news/technology-60953527"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "MSTIC DEV-0537 Mar 2022",
"url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"
},
{
"source_name": "UNIT 42 LAPSUS Mar 2022",
"url": "https://unit42.paloaltonetworks.com/lapsus-group/"
}
]
}Explicit source assertions (44)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1589
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--037e2e7e-5d23-48d6-90e6-796693a0caea
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b33093f-14c3-485e-8d82-f04ebcbe6d01
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c472bde-ea1e-48b4-bd55-a32f276b0b13
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1213.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d9523d3-ab60-48df-b5c5-2778e1727439
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1aa34972-7bed-4e2d-bf72-b7352677de60
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b996e11-03b7-48fc-9ce2-cd08fdf0d07d
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b7d9c6e-8149-4b2f-91a2-e80ec673e42d
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--370fb415-02d5-416c-bb69-d629600dc14b
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e375d96-bc20-431e-ab35-f2e05fb88343
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1591.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f152371-cef7-405b-b586-ec87e774ccb4
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4393f669-4e67-4cd6-a89b-52907138fca7
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5235ff3c-646a-4608-b90e-394bc2c54330
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55af723a-6ca6-449d-be8e-d61a067fbefd
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--565aa787-f255-45c6-9396-8a53bbb3950e
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1588.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a86948b-4058-453a-aa8d-47cdc4346f41
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1598.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60fc3c88-bff5-4a06-88f3-15715e4cafda
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1204
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64c83ccd-f074-4ff2-80c9-05d03f8fc9d3
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1552.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65ebc3e9-e5c1-402d-8d1e-873689b09396
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e54e834-521f-4da8-b3ae-963185496a60
NCC Group LAPSUS Apr 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1593.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72c044ec-4869-4273-aff9-10c14e3326ca
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1136.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7344f9ce-b2ec-4754-b980-4d8d1464d35d
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7647807e-71b6-41e4-b0aa-f23e68b411cd
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1591.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e27f405-1e18-44d7-81d7-bbad57cba9b7
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e307ac4-f569-4606-a500-b5ead2d5967f
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1578.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--816b2bbb-9d91-4cf9-86b2-ff68a9f82969
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--956078f0-e1b1-4be7-9bf3-f03630ec3f1b
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1531
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2798404-09a6-4882-8226-257fe55f788c
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a30f4d65-bb33-4c5f-b278-e8ec73de5bb1
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a360e9a6-541f-4026-9d50-70aa288e49ec
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1621
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a72a96fc-c76e-4c55-9ea6-4315246c15db
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bbd4f6df-b4e4-4e8e-8811-41212aef6264
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1003.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd785740-2234-4bc8-90b9-1d8b1e7f557b
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--beaf6c2d-e416-4edc-8091-414eee53f604
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0a23c9d-a972-46a9-9a86-a440bbfd5d1f
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2b48ab4-6a4f-4252-a40c-7f870276b5a7
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1584.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6a104db-515e-4878-93f1-edfc0c242af9
NCC Group LAPSUS Apr 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca441f47-97e7-4cc3-91af-a75d3aa45f72
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d17f93ce-f419-4297-a6dd-9d745df31b92
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de075e77-f83e-4156-a40f-e7e475e15469
NCC Group LAPSUS Apr 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1199
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2e2fb8d-6b89-4d49-bea9-cca54ae3e56d
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1597.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8183fad-e62c-47f0-8aeb-4f1d7fd36444
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1578.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea60aa14-d556-4031-9d3f-bb673f2d6f68
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec5caf8f-0fb8-4c3b-bd31-08804ff2214e
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1111
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc5c0e5f-b730-4396-9922-7e2e91b4a106
MSTIC DEV-0537 Mar 2022