Lapsus$

How Lapsus$ typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via LAPSUS$.

1. T1589 Gather Victim Identity Information Reconnaissance

   What they do: LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.

   What that means: Adversaries may gather information about the victim's identity that can be used during targeting.

2. T1589.001 Credentials Reconnaissance

   What they do: LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.

   What that means: Adversaries may gather credentials that can be used during targeting.

3. T1589.002 Email Addresses Reconnaissance

   What they do: LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.

   What that means: Adversaries may gather email addresses that can be used during targeting.

4. T1591.002 Business Relationships Reconnaissance

   What they do: LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships.

   What that means: Adversaries may gather information about the victim's business relationships that can be used during targeting.

5. T1591.004 Identify Roles Reconnaissance

   What they do: LAPSUS$ has gathered detailed knowledge of team structures within a target organization.

   What that means: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting.

6. T1593.003 Code Repositories Reconnaissance

   What they do: LAPSUS$ has searched public code repositories for exposed credentials.

   What that means: Adversaries may search public code repositories for information about victims that can be used during targeting.

7. T1597.002 Purchase Technical Data Reconnaissance

   What they do: LAPSUS$ has purchased credentials and session tokens from criminal underground forums.

   What that means: Adversaries may purchase technical information about victims that can be used during targeting.

8. T1598.004 Spearphishing Voice Reconnaissance

   What they do: LAPSUS$ has called victims' help desk to convince the support personnel to reset a privileged account’s credentials.

   What that means: Adversaries may use voice communications to elicit sensitive information that can be used during targeting.

9. T1583.003 Virtual Private Server Resource Development

   What they do: LAPSUS$ has used VPS hosting providers for infrastructure.

   What that means: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting.

10. T1584.002 DNS Server Resource Development

    What they do: LAPSUS$ has reconfigured a victim's DNS records to actor-controlled domains and websites.

    What that means: Adversaries may compromise third-party DNS servers that can be used during targeting.

11. T1586.002 Email Accounts Resource Development

    What they do: LAPSUS$ has payed employees, suppliers, and business partners of target organizations for credentials.

    What that means: Adversaries may compromise email accounts that can be used during targeting.

12. T1588.001 Malware Resource Development

    What they do: LAPSUS$ acquired and used the Redline password stealer in their operations.

    What that means: Adversaries may buy, steal, or download malware that can be used during targeting.

13. T1588.002 Tool Resource Development

    What they do: LAPSUS$ has obtained tools such as RVTools and AD Explorer for their operations.

    What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.

14. T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

    What they do: LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.

    What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

15. T1078.004 Cloud Accounts Initial AccessPersistencePrivilege EscalationStealth

    What they do: LAPSUS$ has used compromised credentials to access cloud assets within a target organization.

    What that means: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

16. T1133 External Remote Services Initial AccessPersistence

    What they do: LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix.

    What that means: Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

17. T1199 Trusted Relationship Initial Access

    What they do: LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.

    What that means: Adversaries may breach or otherwise leverage organizations who have access to intended victims.

18. T1204 User Execution Execution

    What they do: LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system.

    What that means: An adversary may rely upon specific actions by a user in order to gain execution.

19. T1098.003 Additional Cloud Roles PersistencePrivilege Escalation

    What they do: LAPSUS$ has added the global admin role to accounts they have created in the targeted organization's cloud instances.

    What that means: An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant.

20. T1136.003 Cloud Account Persistence

    What they do: LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.

    What that means: Adversaries may create a cloud account to maintain access to victim systems.

21. T1068 Exploitation for Privilege Escalation Privilege Escalation

    What they do: LAPSUS$ has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.

    What that means: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

22. T1684.001 Impersonation Stealth

    What they do: LAPSUS$ has called victims' help desk and impersonated legitimate users with previously gathered information in order to gain access to privileged accounts.

    What that means: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf.

23. T1578.002 Create Cloud Instance Defense Impairment

    What they do: LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.

    What that means: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses.

24. T1578.003 Delete Cloud Instance Defense Impairment

    What they do: LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.

    What that means: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence.

25. T1003.003 NTDS Credential Access

    What they do: LAPSUS$ has used Windows built-in tool `ntdsutil` to extract the Active Directory (AD) database.

    What that means: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.

26. T1003.006 DCSync Credential Access

    What they do: LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.

    What that means: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.

27. T1111 Multi-Factor Authentication Interception Credential Access

    What they do: LAPSUS$ has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.

    What that means: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources.

28. T1552.008 Chat Messages Credential Access

    What they do: LAPSUS$ has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.

    What that means: Adversaries may directly collect unsecured credentials stored or passed through user communication services.

29. T1555.003 Credentials from Web Browsers Credential Access

    What they do: LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer.

    What that means: Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

30. T1555.005 Password Managers Credential Access

    What they do: LAPSUS$ has accessed local password managers and databases to obtain further credentials from a compromised network.

    What that means: Adversaries may acquire user credentials from third-party password managers.

31. T1621 Multi-Factor Authentication Request Generation Credential Access

    What they do: LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.

    What that means: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.

32. T1069.002 Domain Groups Discovery

    What they do: LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.

    What that means: Adversaries may attempt to find domain-level groups and permission settings.

33. T1087.002 Domain Account Discovery

    What they do: LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.

    What that means: Adversaries may attempt to get a listing of domain accounts.

34. T1005 Data from Local System Collection

    What they do: LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.

    What that means: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

35. T1114.003 Email Forwarding Rule Collection

    What they do: LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.

    What that means: Adversaries may setup email forwarding rules to collect sensitive information.

36. T1213.001 Confluence Collection

    What they do: LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.

    What that means: Adversaries may leverage Confluence repositories to mine valuable information.

37. T1213.002 Sharepoint Collection

    What they do: LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.

    What that means: Adversaries may leverage the SharePoint repository as a source to mine valuable information.

38. T1213.003 Code Repositories Collection

    What they do: LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.

    What that means: Adversaries may leverage code repositories to collect valuable information.

39. T1213.005 Messaging Applications Collection

    What they do: LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.

    What that means: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.

40. T1090 Proxy Command and Control

    What they do: LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.

    What that means: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

41. T1485 Data Destruction Impact

    What they do: LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.

    What that means: Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

42. T1489 Service Stop Impact

    What they do: LAPSUS$ has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

43. T1531 Account Access Removal Impact

    What they do: LAPSUS$ has removed a targeted organization's global admin accounts to lock the organization out of all access.

    What that means: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.

Software Lapsus$ has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.