Lapsus$

Lapsus$, stylised as LAPSUS$ and classified by <a href="/facts/Microsoft/nGIDDXdx">Microsoft</a> as Strawberry Tempest, is an international <a href="/facts/Extortion/tv3TraAp">extortion</a>-focused <a href="/facts/Hacker_group/pPu6k66C">hacker group</a> known for its various <a href="/facts/Cyberattack/6PSQzq7y">cyberattacks</a> against companies and government agencies. The group was active in several countries, and has had its members arrested in Brazil and the UK in 2022. According to <a href="/facts/City_of_London_Police/6H5b9VId">City of London Police</a> at least two of the members were teenagers. 
Lapsus$ uses a variety of attack vectors, including <a href="/facts/Social_engineering_(security)/7obTw773">social engineering</a>, <a href="/facts/Multi-factor_authentication_fatigue_attack/7Excwln4">MFA fatigue</a>, <a href="/facts/SIM_swapping/3AWJ5GGE">SIM swapping</a>, and targeting suppliers. Once the group has gained the credentials to a privileged employee within the target organisation, the group then attempts to obtain sensitive data through a variety of means, including using <a href="/facts/Remote_desktop/gJgglwht">remote desktop</a> tools. Attempts at extortion follow. Initially, the messaging app <a href="/facts/Telegram_(software)/TqaAlHwN">Telegram</a> had been used for communications to the public, including recruitment and posting sensitive data from their victims. 
The first major cyberattack attributed to Lapsus$ was against the <a href="/facts/Ministry_of_Health_(Brazil)/3ADuX0vj">Brazilian Health Ministry</a>'s computer systems in December 2021. Lapsus$ gained notoriety for a series of cyberattacks against large tech companies, including <a href="/facts/Microsoft/nGIDDXdx">Microsoft</a>, <a href="/facts/Nvidia/8QfCgqbu">Nvidia</a>, and <a href="/facts/Samsung/oNXUwDjn">Samsung</a>. Following these attacks, the <a href="/facts/City_of_London_Police/6H5b9VId">City of London Police</a> announced that it had made seven arrests in connection to a police investigation into Lapsus$. Although the group had been considered inactive by April 2022, it is believed to have re-emerged in September 2022 with a series of data breaches against various large companies through a similar attack vector, including <a href="/facts/Uber/qUk7gDdX">Uber</a> and <a href="/facts/Rockstar_Games/xA9Gg7Ms">Rockstar Games</a>, with subsequent arrests again by City of London Police, and Brazilian police. The group appears to have become inactive after September 2022, with members perhaps dispersing to other groups, and the conviction of two British members. One of the group's founding members, Arion Kurtaj, was given an order to indefinitely remain in a secure <a href="/facts/Psychiatric_hospital/d6BxCD3e">psychiatric facility</a>.

Lapsus$ open-in-new

Lapsus$