Loading story…
Microsoft confirmed that LAPSUS$ compromised a single employee account and used that foothold to gain limited access to internal source-code repositories, leading to the leak of code tied to projects including Bing, Cortana, and Bing Maps. The company said no customer code or customer data was affected and that the compromised account was remediated, but the incident reinforced the group’s ability to turn relatively simple access methods into high-impact breaches at globally recognized targets.
Reporting across multiple investigations describes LAPSUS$ as a fast-moving data extortion actor that relied heavily on social engineering, SIM swapping, credential theft, session-token abuse, MFA fatigue, help-desk manipulation, and purchases or solicitation of insider access rather than advanced malware or ransomware deployment. The group publicly used Telegram to leak stolen data, pressure victims, and recruit access brokers, and it was linked to intrusions affecting organizations including NVIDIA, Okta, Samsung, Microsoft, Vodafone Portugal, Ubisoft, LG, and Brazil’s Ministry of Health; researchers said its behavior mixed financial motives with disruption, publicity, and notoriety, suggesting the threat could persist through remaining members or copycat actors even after arrests.
Get the infrastructure and lures behind it.
18 events from the most recent confirmed update back to the earliest known activity.
Security Affairs reported that LAPSUS$ shared a torrent for a 7zip archive containing 9 GB of Microsoft source code, reportedly expanding to 37 GB uncompressed across hundreds of projects. The leaked material allegedly included code from Bing, Cortana, and Bing Maps.
S2W reported that LAPSUS$ leaked dump files containing LG employee and service-account hashes. The group claimed it had hacked LG twice within a year.
S2W reported that Ubisoft disclosed an incident that temporarily disrupted some games, systems, and services and prompted a company-wide password reset. The report said LAPSUS$ referenced Ubisoft on its Telegram channel and likely attempted a real intrusion.
S2W reported that LAPSUS$ leaked Samsung data including TrustZone applet source code, biometric unlock algorithms, bootloader code, Qualcomm-related code, and account-related source code. The group distributed about 190 GB via torrents and claimed to use more than 10 Azure servers as seeders.
S2W reported that LAPSUS$ previewed screenshots of Samsung source code before the full leak. This preceded publication of a much larger Samsung data set.
S2W reported that NVIDIA disclosed a cybersecurity incident affecting IT resources and said it had notified law enforcement and incident response experts. The report said LAPSUS$ claimed to have stolen 1 TB of data including employee email addresses, password hashes, source code, circuit designs, drivers, firmware, and internal tools.
S2W reported that Vodafone Portugal disclosed a cyberattack that disrupted 4G/5G, fixed voice, television, SMS, and voice/digital response services, while saying customer data was not affected. The report added that LAPSUS$ claimed to have stolen 500 GB of sensitive information and referenced Vodafone Global/UK data.
S2W reported that Localiza Rent a Car SA's website redirected users to a pornographic site for about two hours and later became inaccessible due to a DNS error. The incident was attributed to suspected DNS spoofing, and LAPSUS$ claimed responsibility without mentioning data theft.
S2W reported that LAPSUS$ continued attacks against Brazilian government websites after the Ministry of Health incident. The activity was said to continue through late December 2021.
S2W said LAPSUS$ claimed to have hacked Brazil's Ministry of Health, accessed its AWS environment, stolen about 50 TB of data, and deleted internal system data. The group also defaced ministry websites and later claimed access to SisReg, vCenter, and ConecteSUS-related systems.
S2W reported that LAPSUS$ created its own Telegram channel and used it to publicize attacks and leaks. CYFIRMA described Telegram as the group's only official communication method for publishing stolen data and interacting with followers.
CYFIRMA stated that LAPSUS$ was using insider-solicitation techniques as early as November 2021, publicly seeking employees of target companies to provide access. This tradecraft later became associated with intrusions including Microsoft.
S2W reported the earliest traced LAPSUS$ activity on RaidForums, where the group allegedly offered stolen Schlumberger customer and employee records for sale. The report also assessed that the actor had previously used the names APT 777 and GoldFish Team before adopting LAPSUS$.
Microsoft confirmed that LAPSUS$ compromised a single employee account and used it to gain limited access to source code repositories. The company said no customer code or customer data was affected and that response teams remediated the account to prevent further activity.
CYFIRMA reported that a 16-year-old and a 17-year-old appeared in court in the UK charged with cyber offenses tied to the broader LAPSUS$ story. The article emphasized that the group remained active despite these arrests and public exposure of alleged members.
Both CYFIRMA and S2W reported that after hacking NVIDIA, LAPSUS$ demanded removal of Lite Hash Rate restrictions on GPUs and later demanded that NVIDIA open source its GPU drivers. CYFIRMA assessed these demands as aimed more at notoriety and pleasing followers than direct profit.
S2W reported that LAPSUS$ hacked Grupo Impresa, affecting SIC and Expresso, including compromise of Expresso's Twitter account and SMS messages sent to customers. CYFIRMA also identified Impresa as one of the group's early public victims.
S2W reported that LAPSUS$ claimed to have stolen data from Claro, Embratel, and NET, asserting access to AWS, GitLab, vCenter, storage systems, inboxes, telecom infrastructure, and customer-management systems. The group claimed to possess between 10,000 TB and 10 PB of data including customer information, legal documents, source code, and emails.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcecyfirma.com
Open sourcesecurityaffairs.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.K. police arrested seven people aged 16 to 21 over suspected links to **Lapsus$**, the extortion-focused hacking group tied to intrusions at **Microsoft, Nvidia, Samsung, Ubisoft, Okta,** and other major firms. Reporting identified a 16-year-old near Oxford as a suspected central figure, while investigators and journalists described the group as a loose set of mostly young operators who stole data, leaked source code and internal documents, and taunted victims publicly on Telegram and other platforms. Microsoft confirmed the group obtained source code through **limited access**, reinforcing the scale and credibility of the campaign. The activity continued to expand as **Globant** disclosed unauthorized access to a limited portion of its code repository after Lapsus$ leaked **70GB** of allegedly stolen data. The company said the exposed material appeared limited to certain source code and project documentation for a small number of clients, and that it had not found evidence of broader compromise. Coverage of the group highlighted that its operators often relied on comparatively simple but highly effective tactics—including **social engineering, SIM swapping, MFA fatigue attacks,** and attempts to bribe insiders—showing how basic intrusion methods enabled a string of high-profile breaches and data leaks.
Jun 29, 2026
Microsoft said **DEV-0537**, also tracked as **LAPSUS$** and later **Strawberry Tempest**, ran a broad campaign of identity-driven intrusions that led to data theft, extortion, and destructive actions against organizations in government, technology, telecom, media, retail, healthcare, manufacturing, energy, and higher education. The group reportedly gained access through stolen credentials, session token replay, **MFA fatigue**, SIM swapping, help-desk social engineering, and recruiting insiders or suppliers, then moved to reconnaissance, privilege escalation, data exfiltration, and deletion of cloud and on-premises resources. Microsoft also disclosed that the actor accessed a single Microsoft account with limited permissions and viewed some source code, but said no customer code or customer data was affected. The reporting and Microsoft guidance underscore that push-based MFA abuse was a key part of the actor’s playbook, prompting stronger controls around authentication workflows. Microsoft’s Entra documentation says **number matching** is now enabled for Authenticator push notifications to replace weaker approve/deny prompts, extending across Entra MFA, self-service password reset, combined registration, and supported AD FS deployments, while older or unsupported environments may still require updates or alternate methods such as TOTP. The company recommended hardening identity protections, restricting access to trusted devices, improving cloud security posture, and preparing incident-response teams for adversaries that may monitor or interfere with response communications.
Aug 15, 2026
Nvidia said a cyberattack exposed employee credentials and proprietary data after the extortion group **Lapsus$** claimed it had breached the company’s corporate network and stolen more than **1TB** of information. Reports said the stolen material included schematics, firmware and driver source code, and a leak of usernames and cryptographic password hashes for **71,335 employees**. The group also issued an unusual extortion demand, threatening further leaks unless Nvidia removed its **Lite Hash Rate (LHR)** restrictions from GeForce RTX 30-series graphics cards. The fallout expanded beyond the initial intrusion as attackers began using **stolen Nvidia code-signing certificates** to sign malware and malicious Windows drivers, including tools such as **Cobalt Strike**, **Mimikatz**, backdoors, RATs, and a Quasar sample. Researchers warned that even expired certificates could still allow signed drivers to load in Windows, complicating defenses and raising the risk of broader downstream abuse. The incident unfolded amid wider concern over high-profile intrusions linked to Lapsus$, including a separate breach that prompted **Ubisoft** to order a company-wide password reset.
Jun 29, 2026