LAPSUS$

{
  "id": "ATTACK:mobile:G1004",
  "title": "LAPSUS$",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1004",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--d8bc9788-4f7d-41a9-9e9d-ee1ea18a8cf7",
  "external_id": "G1004",
  "domain": "mobile",
  "created": "2022-06-09T19:14:31.327Z",
  "modified": "2026-07-31T20:48:49.009Z",
  "version": "2.1",
  "aliases": [
    "LAPSUS$",
    "DEV-0537",
    "Strawberry Tempest"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Strawberry Tempest"
    },
    {
      "source_name": "DEV-0537"
    },
    {
      "source_name": "BBC LAPSUS Apr 2022",
      "url": "https://www.bbc.com/news/technology-60953527"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "MSTIC DEV-0537 Mar 2022",
      "url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"
    },
    {
      "source_name": "UNIT 42 LAPSUS Mar 2022",
      "url": "https://unit42.paloaltonetworks.com/lapsus-group/"
    }
  ]
}