LAPSUS$

LAPSUS$ is a financially motivated cybercrime and extortion group best known for high-profile intrusions against major technology, telecommunications, gaming, and identity-management organizations. The group is widely associated with aggressive social engineering, credential theft, insider recruitment or bribery, and abuse of legitimate remote access and identity workflows rather than reliance on bespoke malware. Commonly cited aliases include DEV-0537, Slippy Spider, Strawberry Tempest, Lapsus, and Lapsus Group. LAPSUS$ gained prominence through intrusions affecting organizations such as Nvidia, Microsoft, Samsung, Ubisoft, Okta, Globant, and Rockstar Games, and has also been linked in reporting to attacks involving BT/EE. Its operations have often centered on stealing source code, internal communications, authentication data, and other sensitive corporate information, then using public leak channels and extortion pressure to coerce victims. The group has demonstrated a willingness to publicize stolen data rapidly and to blend data theft with reputational pressure. Tradecraft attributed to LAPSUS$ consistently emphasizes human-centric intrusion methods. Reported techniques include vishing and other social-engineering pretexts against help desks and employees, exploitation of authentication and account-recovery processes, privilege escalation after initial access, and use of compromised or insider-enabled credentials to move through enterprise environments. The actor has been associated with abuse of identity infrastructure and with attacks that illustrate the systemic risk posed by compromise of SaaS and identity providers. LAPSUS$ is frequently described as part of, or overlapping with, the broader English-speaking cybercriminal ecosystem known as The Com. Reporting also notes operational intersections or collaboration claims involving Scattered Spider, ShinyHunters, TeamPCP, and Vect. In particular, LAPSUS$ has been described as partnering with other extortion actors to monetize stolen data, including joint sale activity and leak-site amplification. Some individuals publicly tied to LAPSUS$ have also been linked to Scattered Spider and The Com, underscoring the loose, decentralized, and personnel-overlapping nature of this ecosystem. Law-enforcement actions in the United Kingdom have tied several young offenders to LAPSUS$, including individuals connected to the Nvidia and Rockstar-related intrusions. Despite arrests and prosecutions, the LAPSUS$ name continues to appear in extortion and breach claims, though some later attributions and victim claims remain unconfirmed. Overall, LAPSUS$ is best characterized as a high-impact cyber extortion actor whose hallmark is rapid, socially engineered compromise of prominent targets followed by theft and coercive disclosure of sensitive data.