Loading threat actor…
LAPSUS$, also tracked as DEV-0537, Strawberry Tempest, and Slippy Spider, is a cybercriminal group known for high-profile data theft, public leaks, and extortion. It emerged publicly in December 2021, initially targeting Latin American organizations before expanding to major multinational companies. Victims include Brazil’s Ministry of Health, Portuguese media group Impresa, South American telecommunications organizations, Microsoft, Nvidia, Samsung, and Okta through its customer-support provider Sitel/Sykes. The group emphasizes identity compromise and social engineering. Its techniques include stealing passwords and session tokens with RedLine, impersonating employees to obtain helpdesk password resets, abusing SIM swaps, and repeatedly issuing multifactor-authentication requests until users approve them. It has also recruited employees willing to provide enterprise remote-access credentials. Compromised accounts provide access through VPNs, RDP, and virtual desktop infrastructure, including Citrix. During the Sitel/Sykes intrusion in January 2022, LAPSUS$ used exposed credentials for initial access, exploited a local privilege-escalation vulnerability, created an account, and moved laterally using RDP. It used publicly available tools including Mimikatz and Process Hacker, terminated endpoint protection, obtained administrative group membership, accessed sensitive internal information, and configured email forwarding to attacker-controlled accounts. Its Nvidia intrusion exposed approximately one terabyte of data, including code-signing certificates subsequently abused by other attackers. LAPSUS$ uses Telegram to announce victims, publish stolen information, communicate demands, recruit insiders, and solicit follower votes on future targets. Its established extortion model relies on stolen data and disclosure threats rather than file encryption. Public mockery, interference with incident-response calls, and intimidation of victim personnel supplement its pressure tactics. Its activities combine monetary demands with publicity-seeking behavior and nonmonetary demands, including requests that Nvidia remove cryptocurrency-mining restrictions and release GPU driver source code.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
51 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
20 malware families attributed to this actor across reporting.
15 additional families tracked in Mallory.
28 CVEs this actor has used in observed campaigns. 28 of them exploited in the wild.
BleepingComputer reported that threat actors leveraged credentials stolen through the Trivy supply chain compromise (CVE-2026-33634) to breach Cisco's internal development environment... The CISA KEV remediation deadline for CVE-2026-33634 is today, April 8, 2026... Beyond patching Trivy to v0.69.2+, trivy-action to v0.35.0, or setup-trivy to v0.2.6, organizations must also complete credential rotation for any secrets that may have been exposed during the March 19-27 compromise window.
The CVE-2025-61882 campaign is particularly instructive. CrowdStrike assessed with moderate confidence that GRACEFUL SPIDER was involved in mass exploitation of that vulnerability... Exploitation had begun nearly two months earlier on August 9, 2025, well before Oracle's public disclosure.
CVEs targeted by Lapsus$ CVE-2021-31207: Microsoft Exchange Server Security Feature Bypass Vulnerability
CVEs targeted by Lapsus$ CVE-2021-34473: Microsoft Exchange Server Remote Code Execution Vulnerability
CVEs targeted by Lapsus$ CVE-2018-13379: An Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) in Fortinet
23 more CVEs tied to this actor tracked in Mallory.
43 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named by an incident responder as a group observed using psychological and physical threats to pressure victims into paying extortion demands. The article provides no group-specific incident details.
Referenced as a historical comparison for data-extortion threats against UK organizations, not as an attributed participant in the ASOS incident. The access techniques are discussed collectively rather than tied to a specific Lapsus$ operation.
Mentioned only as a constituent group of Scattered LAPSUS$ Hunters; no independent operations or techniques are described.
Named only as a constituent group of Scattered LAPSUS$ Hunters. The article does not separately attribute attacks, targets, malware, or techniques to LAPSUS$.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.