Quick links
Press Enter to search, Esc to close
Threat group profile
The US Cyber Safety Review Board describes Lapsus$ as a loosely organized, extortion-focused criminal group based mainly in the United Kingdom and Brazil, and UK and Brazilian police have made arrests in cases linked to it.
In short
The US Cyber Safety Review Board describes Lapsus$ as a loosely organized, extortion-focused criminal group based mainly in the United Kingdom and Brazil, and UK and Brazilian police have made arrests in cases linked to it. It tricked staff, used stolen logins, and stole or deleted company data.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| LAPSUS$ | MITRE ATT&CK G1004 (group name); US Cyber Safety Review Board report[1, 2] |
| DEV-0537 | MITRE ATT&CK (Associated Groups)[1] |
| Strawberry Tempest | MITRE ATT&CK (Associated Groups)[1] |
| Lapsus Group | Brazilian Federal Police statement of 19 October 2022[6] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page version 2.1, last modified 31 July 2026
Describes LAPSUS$ as a cyber criminal threat group active since at least mid-2021, specializing in social engineering and extortion, including destructive attacks without ransomware.[1]
Brazilian Federal Police 16 August 2022
Opened an inquiry on 10 December 2021 after the Ministry of Health cloud was attacked. Launched Operation Dark Cloud against a transnational criminal organization.[7]
Brazilian Federal Police 19 October 2022
Arrested the main Brazilian suspect of belonging to the transnational criminal organization it calls LAPSUS GROUP, and named it as responsible for attacks on federal bodies and companies.[6]
US Healthcare Sector Cybersecurity Coordination Center (HHS) 7 April 2022
Said members are believed to be from Portugal and Latin America, possibly teenagers and young adults, and that the health sector is within their scope.[4]
City of London Police 1 April 2022
Charged two teenagers in connection with an investigation into a hacking group. The Cyber Safety Review Board links this to Lapsus$.[2, 5]
US Cyber Safety Review Board (DHS) Report dated 24 July 2023, published 10 August 2023
Described Lapsus$ as a transnational group based mainly in the UK and Brazil with 8 to 10 known members as of April 2022, and as a loosely organized group that included several juveniles.[2, 3]
US Cyber Safety Review Board (DHS) 24 July 2023
Said it did not try to attribute any attack to Lapsus$ conclusively, and focused on common techniques instead.[2]
FBI, as cited by the Cyber Safety Review Board 24 July 2023
Last observed Lapsus$ activity in September 2022 and assessed that the drop in activity was likely due to the arrests.[2]
City of London Police Commissioner, report to the Police Authority Board 7 February 2024
Said two teenagers convicted after a City of London Police Cyber Crime Unit investigation were key players in a hacking group known as Lapsus$.[8]
Sources differ on when the group started. MITRE says since at least mid-2021, the Cyber Safety Review Board says it was first tracked as a named group between September and December 2021 with forum claims from June 2021, and the US health-sector briefing says first identified around April 2020. Sources also differ on where members were based: the Board says mainly the UK and Brazil, while the US health-sector briefing says believed to be from Portugal and Latin America. The Board gives 24 March 2022 for the announcement of seven arrests, and the US health-sector briefing gives 25 March 2022. On ransoms, the FBI told the Board it found no evidence that anyone ever paid, while other experts cited by the Board saw some victims pay. On motive, the group claimed profit only, and the Board says notoriety, amusement and ideology also appear plausible.
Each entry is attributed to the group by the sources cited.
The Cyber Safety Review Board says some researchers saw people using the Lapsus$ name in forums to claim attacks as early as June 2021.[2]
The Board says the threat intelligence community first tracked Lapsus$ as a named group in this period, when it first posted on its public Telegram channel and attacked South American targets.[2]
The Board says Lapsus$ announced on 29 March that it was back from vacation. The last observed message on its public Telegram channel is dated 30 March 2022.[2]
The US Healthcare Sector Cybersecurity Coordination Center briefs that the health sector is within the group's scope.[4]
The Board says the financially motivated Nwgen Team split off from Lapsus$ in mid-2022.[2]
Brazil's federal police launch Operation Dark Cloud with eight search warrants in four states, against a transnational criminal organization.[7]
The Board says the FBI last observed Lapsus$ activity in September 2022 and that the group appears inactive after that.[2]
The Board says the City of London Police arrested a teenager on suspicion of hacking as part of a National Crime Agency investigation. The announcement gave no details.[2]
Brazil's federal police arrest the main Brazilian suspect of belonging to the organization it calls LAPSUS GROUP, as a follow-up to Operation Dark Cloud.[6]
The City of London Police Commissioner told the Police Authority Board that two convicted teenagers were key players in a hacking group known as Lapsus$, after an investigation by its Cyber Crime Unit.[8]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 24 March 2022 | City of London Police | ArrestsReleased information on the arrest of seven individuals in connection with Lapsus$, as reported by the Cyber Safety Review Board.[2] |
| 1 April 2022 | City of London Police | ChargesTwo teenagers charged with unauthorized access to a computer and fraud by false representation, among other counts. Reporting restrictions apply to their identities.[5] |
| 7 April 2022 | US Healthcare Sector Cybersecurity Coordination Center (HHS) | Threat briefingBriefed health-sector organizations on Lapsus$ and advised measures such as disallowing SMS and voice sign-in approvals.[4] |
| 16 August 2022 | Brazilian Federal Police | OperationOperation Dark Cloud: eight search warrants in four states over attacks on federal bodies including the Ministry of Health.[7] |
| 22 September 2022 | City of London Police with the National Crime Agency | ArrestArrested a teenager on suspicion of hacking. The Board says the announcement gave no details about the investigation.[2] |
| 19 October 2022 | Brazilian Federal Police | ArrestArrested the main Brazilian suspect of belonging to the organization it calls LAPSUS GROUP. The police list organized crime and unauthorized access to computer devices among the offenses investigated.[6] |
| 24 July 2023 | US Cyber Safety Review Board (DHS) | Review reportReport on the attacks associated with Lapsus$ and related groups, published by CISA on 10 August 2023.[2, 3] |
| 7 February 2024 | City of London Police, report to the Police Authority Board | Convictions reportedReported that an investigation led by its Cyber Crime Unit, supported by the National Crime Agency and the FBI, led to convictions for fraud, Computer Misuse Act offenses and blackmail.[8] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Valid Accounts T1078
MITRE says the group used compromised credentials or session tokens to get into a victim's VPN, VDI, RDP and identity systems.[1]
Trusted Relationship T1199
MITRE says the group accessed internet-facing identity providers to target specific organizations.[1]
SIM Card Swap T1451
MITRE lists SIM swapping against victims' mobile devices. The Board says SIM swaps gave attackers initial access in several instances among the groups it studied.[1, 2]
Mimikatz Credential dumper
Listed in MITRE's software table for the group. MITRE describes it as a tool that can obtain plaintext Windows logins and passwords.[1, 4, 9]
Redline password stealer Information-stealing malware
MITRE says the group acquired and used it to obtain passwords and session tokens.[1, 4]
AD Explorer Active Directory browsing tool
MITRE says the group used it to list users and groups on a victim's network.[1, 4]
RVTools Virtual machine inventory tool
MITRE says the group obtained it for its operations.[1]
ntdsutil Built-in Windows utility
MITRE says the group used it to extract the Active Directory database.[1]
Remote management software Legitimate remote access tools
MITRE says insiders were recruited to install remote management software so the group could control an authenticated system.[1]
Commercial VPN services Anonymizing service
The Board says the groups it studied used commercial VPN services to appear close to their targets and avoid impossible-travel alerts.[2]
Watch for company logins and session tokens offered for sale, since MITRE and the Board describe the group buying credentials.
Follow what the government sources report about this group and check your sign-in, help desk and SIM-swap controls against it.
Help leaders and staff find exposed personal accounts and details, since MITRE says the group gathered employee personal email addresses.
Find look-alike domains and fake sign-in pages, since the Board describes spoofed sites and text messages used to harvest logins.
The US Cyber Safety Review Board describes it as a loosely organized, extortion-focused criminal group based mainly in the UK and Brazil. MITRE says it has been active since at least mid-2021.
The Board says the FBI last observed activity in September 2022 and that the group appears inactive after that, but it cannot rule out members joining other groups or rebranding. We found no later government report of activity under this name.
MITRE lists government, manufacturing, higher education, energy, healthcare, technology, telecommunications and media. The Board adds outsourcing firms and telecom providers.
Mostly by tricking people and using logins: stolen or bought credentials, calls to help desks, repeated sign-in prompts, SIM swaps and paid insiders. The Board says Lapsus$ used no novel zero-day techniques.
The City of London Police announced arrests in March 2022 and charges against two teenagers in April 2022. Brazil's federal police arrested a suspect in October 2022. A February 2024 police report describes two convicted teenagers as key players in Lapsus$.
Replace SMS and voice sign-in codes with phishing-resistant sign-in, tighten help desk password resets, and keep tested backups.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.