- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Brazil(high confidence)
- Motivation
- Financial gain
- Seen
- 2021–2026
- Status
- Active
- ATT&CK
- G1004 · 44 techniques
- Sources
- 13 sources carry it
- Identifier
- GINC-APT-0016 · lapsus
BrazilWhat it is
LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Slippy Spider
- Mandiant
- UNC3661
- Microsoft
- Strawberry Tempest, DEV-0537
- MITRE ATT&CK
- G1004
- PwC
- White Dev 111
- Other names
- LAPSUS, Gold Rainforest
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTBrazil
- ThreatActor.info (Malpedia et al.)Brazil · high
Targets
- Countries
- Argentina, Brazil, Portugal, United States
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- Mimikatz
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de