Lapsus$ showed that a loosely organised group of mostly young criminals could breach large technology companies without malware or exploits, simply by talking, paying or pestering their way past identity controls. Between late 2021 and 2022 the group stole source code and data from household names, then published it or demanded payment, using SIM swaps, MFA push spam, help desk impersonation and paid insiders. This profile covers its names and aliases, targeting, the ATT&CK techniques it used, the identity weaknesses it exploited, its best documented incidents and the defences that the US Cyber Safety Review Board (CSRB) and Microsoft recommended afterwards. It is written for identity, security operations and service desk leaders, because the same playbook is still in use by successor groups.
Key takeaways
- Identity was the whole attack surface. Lapsus$ relied on valid credentials, MFA approval and help desk resets rather than exploits, and the CSRB found that simple techniques beat well resourced security programmes.
- SMS, voice and simple push MFA failed. SIM swapping and MFA fatigue defeated the most common second factors, which is why the CSRB urged a move to passwordless, phishing-resistant authentication such as FIDO2.
- Insiders and suppliers were bought or borrowed. The group openly advertised for employees and contractors to sell access, and it reached Okta customers through a support contractor's workstation.
- Secrets in collaboration tools turned one account into many. After entry, Lapsus$ searched Slack, Teams, Confluence, Jira, SharePoint and code repositories for further credentials, then took over cloud tenants as global administrator.
- The playbook outlived the group. Members were arrested and two UK teenagers were found responsible in 2023, but Scattered Spider and ShinyHunters-branded crews have reused the same help desk and MFA techniques.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as G1004 LAPSUS$ and describes it as a criminal group active since at least mid-2021 that specialises in large scale social engineering and extortion, including destructive attacks without ransomware. The CSRB, which reviewed the group in its report published on 10 August 2023, records that Lapsus$ was first observed between September and December 2021, had an estimated eight to ten members as of April 2022, ran a public Telegram channel with tens of thousands of followers and posted its last public Telegram message on 30 March 2022.
| Name | Who uses it | Notes |
|---|---|---|
| LAPSUS$ / Lapsus$ | The group itself, MITRE ATT&CK, press | Self-chosen brand, announced victims publicly on Telegram |
| DEV-0537 | Microsoft (2022) | Name used in Microsoft's March 2022 analysis |
| Strawberry Tempest | Microsoft (from April 2023) | Replaced DEV-0537 under Microsoft's weather-based naming |
| "Related threat groups" | CSRB | The CSRB review covered Lapsus$ and associated actors using the same techniques |
ATT&CK places Lapsus$, Scattered Spider (G1015) and ShinyHunters (G1057) within the wider online criminal community often called The Com, and public reporting in 2025 used the label "Scattered LAPSUS$ Hunters" for collaboration between members of these groups. That label is a criminal brand, not proof the original crew is active. See the Scattered Spider Threat Actor Profile and the Threat Actor Groups Guide.
Targeting and motivation
Lapsus$ wanted money and notoriety. Microsoft described a "pure extortion and destruction model" without ransomware payloads: some victims were asked to pay to prevent publication, while in other cases data was simply leaked.
- Early activity: according to Microsoft, cryptocurrency accounts, with theft of wallets and funds.
- Regional expansion: telecommunications, higher education and government bodies in the UK and South America.
- Global technology firms: government, technology, telecoms, media, retail, healthcare, manufacturing, energy, higher education and IT services. Source code was a favoured prize.
- Supply chain and support providers: telecoms carriers, IT support firms and business process outsourcers (BPOs), because one support contractor can reach many downstream customers. The CSRB singled out BPOs and SaaS providers as consolidation points.
- Telecoms carriers as enablers: carrier employee accounts, customer management tools and retail point-of-sale devices were abused to perform SIM swaps on targets, according to the CSRB.
Tactics and techniques (MITRE ATT&CK)
The table lists techniques that ATT&CK v20 associates with G1004, checked against the v20 dataset.
| Tactic | Technique | How Lapsus$ used it |
|---|---|---|
| Reconnaissance | T1589.001 Credentials; T1597.002 Purchase Technical Data | Bought credentials and session tokens from criminal forums and infostealer logs |
| Reconnaissance | T1598.004 Spearphishing Voice | Phone calls to staff and help desks to obtain credentials and resets |
| Initial access | T1078 Valid Accounts; T1133 External Remote Services | Logged in through VPN, RDP, VDI (including Citrix) and identity providers |
| Initial access | T1199 Trusted Relationship | Reached victims through suppliers, support contractors and partners |
| Credential access | T1621 Multi-Factor Authentication Request Generation | Repeated push prompts until a user approved one |
| Credential access | T1111 Multi-Factor Authentication Interception | SIM swapping to receive SMS and voice codes |
| Stealth | T1684.001 Impersonation | Posed as employees to help desks, using profile photos and recovery answers |
| Credential access | T1555.003 Credentials from Web Browsers; T1555.005 Password Managers | Harvested saved passwords from browsers and vaults |
| Credential access | T1552.008 Chat Messages; T1003.003 NTDS; T1003.006 DCSync | Searched chat for secrets, then dumped Active Directory |
| Collection | T1213.001 Confluence; T1213.002 Sharepoint; T1213.003 Code Repositories; T1213.005 Messaging Applications | Mined wikis, repositories, Slack and Teams for credentials and source code |
| Privilege escalation | T1068 Exploitation for Privilege Escalation | Exploited unpatched internal Confluence, Jira and GitLab servers |
| Persistence | T1136.003 Cloud Account; T1098.003 Additional Cloud Roles | Created new global administrator accounts in cloud tenants |
| Collection | T1114.003 Email Forwarding Rule | Tenant-wide transport rule sending all mail to an attacker account |
| Impact | T1531 Account Access Removal; T1485 Data Destruction; T1489 Service Stop | Removed other administrators and deleted cloud and VMware resources |
Microsoft also reported that the group chose NordVPN egress points close to its victims to avoid impossible travel alerts, and joined victims' incident bridges and chat channels to watch the response. See the MITRE ATT&CK Guide for Defenders.
How they abuse identities and credentials
Almost every Lapsus$ intrusion began with a real person's identity. The routes below come from Microsoft's March 2022 analysis and the CSRB report.
- Paid insiders: the group advertised on social media for employees, contractors and suppliers willing to hand over credentials, approve MFA prompts or install remote management software such as AnyDesk. See the Insider Threat and Identity Guide.
- SIM swapping: by taking over a target's phone number, the group received SMS and voice codes and could pass phone-based recovery. The CSRB found a paid SIM swap market, insiders at carriers and fraudulent Emergency Disclosure Requests sent to providers. See the SIM Swap Fraud Guide.
- MFA fatigue: repeated push prompts, often at night according to the CSRB, until a tired user approved one. Uber's September 2022 incident followed exactly this pattern. See the MFA Fatigue and Bypass Guide.
- Help desk resets: callers impersonated employees with details gathered from social media and answers to recovery questions to get passwords and MFA reset on privileged accounts. See the Account Recovery and Help Desk Security Guide.
- Infostealer logs and personal accounts: Microsoft named the Redline infostealer as a source of passwords and session tokens, and described compromise of employees' personal accounts as a route to reset work credentials. Cisco's 2022 incident started from a personal Google account with synced browser passwords. See the Infostealer Threat Guide.
- Secrets stored in the wrong places: the CSRB found credentials in spreadsheets, Slack, code repositories and scripts were a common route to privilege escalation, and estimated that Active Directory exploitation featured in 40 to 60 percent of Lapsus$ compromises. Leaked secrets also matter after the fact: the source code Lapsus$ published from Samsung contained thousands of secrets. See the Secrets Management Guide.
- Cloud tenant takeover: once a privileged identity was reached, the group created global administrator accounts, forwarded all mail and removed legitimate administrators, which turned an identity compromise into an outage.
Notable incidents
| Victim and date | What happened | Identity lesson |
|---|---|---|
| Okta, January 2022 (disclosed March 2022) | A Sitel support engineer's workstation was controlled for 25 minutes on 21 January 2022; Okta concluded two customer tenants were accessed via its SuperUser tool, after first estimating up to 366, and ended its relationship with Sykes/Sitel (as reported by The Record) | Support contractors with admin tooling are part of your identity perimeter |
| NVIDIA, February 2022 | Data and code-signing certificates were stolen and leaked; the certificates were later used to sign malware. See the NVIDIA code-signing certificates breach | Signing keys are machine identities and need hardware protection and fast revocation |
| Samsung, March 2022 | About 190GB of source code was published, holding thousands of embedded secrets. See the Samsung source code leak | Secrets in code become public secrets once code leaks |
| Microsoft, March 2022 | Lapsus$ claimed source code theft; Microsoft said a single account was compromised with limited access and no customer code or data was involved | Detection of one account was possible before the group announced it |
| Uber, September 2022 | A contractor's password, probably bought after malware on a personal device, plus repeated MFA prompts gave access; the attacker reached Slack, G-Suite and the HackerOne dashboard. Uber said it believed the attacker was affiliated with Lapsus$. See the Uber breach 2022 | Push MFA without number matching is not enough for contractors |
| Cisco, May 2022 (published August 2022) | Vishing and MFA fatigue after passwords were synced to a personal Google account; Cisco Talos linked the initial access broker, with moderate to high confidence, to UNC2447, Lapsus$ and Yanluowang. See the Cisco breach 2022 | Attribution was to an access broker with Lapsus$ ties, not to Lapsus$ alone |
Law enforcement outcome: in August 2023 a jury at Southwark Crown Court found that Arion Kurtaj, then 18, had carried out attacks on companies including Uber, Revolut and Rockstar Games; he was judged unfit to stand trial, so the jury decided whether he did the acts rather than his intent. In December 2023 he was given an indefinite hospital order. A second defendant, aged 17 and not named, was also found responsible, including for attacks on NVIDIA and BT/EE (as reported by Security Affairs).
Detection and defence
The CSRB's central recommendation was to move away from SMS and voice MFA towards passwordless, phishing-resistant methods such as FIDO2. Microsoft's guidance adds specific tenant controls. Combine both.
| Lapsus$ behaviour | Control | What to log or alert on |
|---|---|---|
| SIM swap, SMS and voice codes | FIDO2 security keys or passkeys; remove SMS and voice as factors and recovery methods | Authentication method changes; sign-ins with SMS after a carrier port |
| MFA push spam | Number matching, or phishing-resistant MFA; limit push retries | Several denied MFA prompts followed by an approval for the same user |
| Help desk impersonation | Strong caller verification (manager approval, video, in-person or pre-registered device) before any reset, stricter for privileged users | Resets followed within minutes by new MFA registration and privileged sign-in |
| Insider recruitment | Awareness that criminals pay for access; reporting route; least privilege for support staff | Unexpected remote management software (AnyDesk and similar) installs |
| Valid account from VPN or VPS | Conditional access requiring compliant devices; block high sign-in risk | Sign-ins from hosting providers and consumer VPN egress |
| Global admin creation | Privileged access with approval and time limits; offline break-glass accounts | Privileged role assignments, Exchange transport rule creation, tenant security setting changes |
| Secret mining in chat and wikis | Secrets scanning of Slack, Teams, Confluence and repositories; vaulting | Bulk search or export in collaboration tools by one account |
| Joining incident calls | Out-of-band channel for responders; verify every participant | Unknown attendees on bridges or new members in response channels |
Implementation sequence
- Protect privileged and support identities first: issue FIDO2 keys to administrators, help desk staff and contractors with admin tooling; pilot with one team, keep a tested fallback for lost keys, then enforce.
- Remove SMS and voice: switch remaining users to number matching or passkeys; run in report-only or audit mode in conditional access for two weeks before enforcing, and keep break-glass accounts excluded and monitored. See the Phishing-Resistant MFA Guide.
- Rewrite the help desk reset procedure: no reset or MFA re-registration on caller knowledge alone; test with a red team call before and after.
- Bring suppliers and BPOs into scope: contractual MFA and device requirements, separate tenants or least privilege support tools, and monitoring of supplier sessions, as the CSRB recommended. See the Third-Party Access Guide.
- Hunt for stored secrets: scan chat, wikis and repositories, rotate what you find and move it to a vault.
- Build detections and rehearse: alert on the events in the table above and run a tabletop where the attacker joins the incident bridge. Rollback for any control is a documented, approved exception, never a silent policy disable.
Metrics
- Phishing-resistant coverage: percentage of privileged and support accounts using FIDO2 or passkeys (target 100 percent).
- Weak factor exposure: number of accounts still able to use SMS or voice for sign-in or recovery.
- Reset assurance: percentage of help desk resets that passed the strong verification step, sampled monthly.
- MFA fatigue signals: count of users with three or more denied prompts in an hour, and time to respond.
- Secrets found in collaboration tools: new findings per month and median time to rotation.
Framework mapping
| Area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Phishing-resistant MFA | IA-2(1), IA-2(2), IA-5 | PR.AA-03 |
| Help desk identity proofing | IA-12 | PR.AA-01 |
| Least privilege and admin accounts | AC-2, AC-6 | PR.AA-05 |
| Social engineering awareness | AT-2, AT-2(3) | PR.AT-01 |
| Suppliers and BPOs | SA-9, SR-6 | GV.SC-07, DE.CM-06 |
| Monitoring and response | AU-6, SI-4, IR-4 | DE.CM-03, RS.MA-01 |
Small organisations should focus on the first three implementation steps: phishing-resistant MFA for administrators, no SMS recovery and a strict reset procedure deliver most of the benefit. Large organisations with outsourced support also need supplier session monitoring and a formal insider risk programme. See the ITDR Guide.
Practitioner checklist
- Inventory every account that can still use SMS or voice for sign-in or recovery, and set a date to remove them.
- Issue FIDO2 keys or passkeys to administrators, help desk agents and contractors with admin tools.
- Enable number matching on any remaining push MFA and alert on repeated denied prompts.
- Require strong verification before any password or MFA reset, with extra checks for privileged users and executives.
- Alert on new global administrator assignments, Exchange transport rules and removal of administrators.
- Block or challenge sign-ins from hosting providers and consumer VPN ranges for privileged roles.
- Scan Slack, Teams, Confluence, SharePoint and repositories for secrets and rotate findings.
- Write supplier and BPO access requirements into contracts and monitor their sessions.
- Keep an out-of-band channel for incident responders and verify every participant on bridges.
Standards and references
- Cyber Safety Review Board: Review of the Attacks Associated with Lapsus$ and Related Threat Groups
- Microsoft: DEV-0537 criminal actor targeting organizations for data exfiltration and destruction
- MITRE ATT&CK: LAPSUS$ (G1004)
- US Department of Homeland Security: Cyber Safety Review Board releases report on Lapsus$
- Uber: Security update
- Cisco Talos: Cisco Talos shares insights related to recent cyber attack on Cisco
- The Record: Okta says two customers breached during January security incident
- Security Affairs: Member of Lapsus$ gang sentenced to an indefinite hospital order
Related NHI Mgmt Group resources: Threat Actor Groups Guide · Scattered Spider Threat Actor Profile · MFA Fatigue and Bypass Guide · Account Recovery and Help Desk Security Guide · SIM Swap Fraud Guide