CyberSIXT Search
Threat actor

LAPSUS$

financial

Tracked by CyberSIXT since 17 Sep 2025

Articles · all time
15
Articles · last 30 days
0
CVEs exploited · attributed · all time
0
Research reports · all time
8

15 articles from 1 outlet; the latest 19 days ago.

LAPSUS$: coverage over time15 articles from 1 outlet, 14 of them before 8 Mar. Busiest week: 1 articles, week of 21 Sep. 0 in the last 7 days. LAPSUS$: coverage over time15 articles from 1 outlet, 14 of them before 8 Mar. Busiest week: 1 articles, week of 21 Sep. 0 in the last 7 days.
  • Article
  • Research report
Show as table
LAPSUS$: articles
Published (UTC)OutletHeadline
Wed 7 Oct · 10:50 UTCMalwarebytesShinyHunters Suspect Arrested in Jordan as FBI Tightens the Net
Tue 22 Sep · 22:00 UTCDataBreachesElsevier Platforms Redirected Users to LAPSUS$ Extortion Pages
Mon 18 May · 19:41 UTCSecurity AffairsGrafana says hackers stole source code after GitHub token breach
Mon 18 May · 09:11 UTCSecurityWeekGrafana Confirms Breach After Hackers Claim They Stole Data
Mon 11 May · 09:50 UTCSecurityWeekMalicious Checkmarx Jenkins Plugin Found in Supply Chain Attack
Fri 8 May · 08:10 UTCSecurityWeekRansomHouse claims Trellix breach, posts service screenshots
Mon 4 May · 17:51 UTCSecurityWeekHackers breach Trellix source code repo, law enforcement notified
Wed 29 Apr · 11:32 UTCSecurityWeekCheckmarx Confirms Data Theft After Trivy Supply Chain Breach
Mon 27 Apr · 15:31 UTCThe Hacker NewsCheckmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack
Tue 14 Apr · 12:11 UTCSecurity AffairsShinyHunters leak Rockstar data via third party cloud breach
Fri 3 Apr · 16:31 UTCDark ReadingTeamPCP supply chain breach hits Mercor and EU Commission clouds
Thu 2 Apr · 10:45 UTCSecurityWeekMercor Hit by LiteLLM Supply Chain Attack
See the full timeline

Names and sources

LAPSUS
Named by CyberSIXT coverage
DEV-0537
Named by Malpedia · lapsus
LAPSUS
Named by Malpedia · lapsus
SLIPPY SPIDER
Named by Malpedia · lapsus
Strawberry Tempest
Named by Malpedia · lapsus
UNC3661
Named by Malpedia · lapsus
DEV-0537
Named by Microsoft · Strawberry Tempest
SLIPPY SPIDER
Named by Microsoft · Strawberry Tempest
All 21 names
Strawberry Tempest
Named by Microsoft · Strawberry Tempest
DEV-0537
Named by MISP Galaxy · d9e5be22-1a04-4956-af6c-37af02330980
LAPSUS
Named by MISP Galaxy · d9e5be22-1a04-4956-af6c-37af02330980
SLIPPY SPIDER
Named by MISP Galaxy · d9e5be22-1a04-4956-af6c-37af02330980
Strawberry Tempest
Named by MISP Galaxy · d9e5be22-1a04-4956-af6c-37af02330980
UNC3661
Named by MISP Galaxy · d9e5be22-1a04-4956-af6c-37af02330980
DEV-0537
Named by MITRE ATT&CK® · G1004
Strawberry Tempest
Named by MITRE ATT&CK® · G1004
Lapsus$
Named by CyberSIXT coverage
LAPSUS$
Named by CyberSIXT coverage
Lapsu$
Named by CyberSIXT coverage
d9e5be22-1a04-4956-af6c-37af02330980
Named by CyberSIXT coverage
lapsu
Named by CyberSIXT coverage

Attributed facts

category
financial (Microsoft · Strawberry Tempest)
motivation
financial (Microsoft · Strawberry Tempest)

Malware and tools

Mimikatz (MITRE ATT&CK® · G1004)

MITRE ATT&CK® techniques

From MITRE ATT&CK® · G1004

Initial Access
T1078
Valid Accounts
T1078.004
Cloud Accounts
Persistence
T1078
Valid Accounts
T1078.004
Cloud Accounts
T1098.003
Additional Cloud Roles
Privilege Escalation
T1068
Exploitation for Privilege Escalation
T1078
Valid Accounts
T1078.004
Cloud Accounts
T1098.003
Additional Cloud Roles
Stealth
T1078
Valid Accounts
T1078.004
Cloud Accounts
Credential Access
T1003.006
DCSync
T1111
Multi-Factor Authentication Interception
Discovery
T1069.002
Domain Groups
T1087.002
Domain Account
Collection
T1005
Data from Local System
T1114.003
Email Forwarding Rule
Command and Control
T1090
Proxy

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK

Also mentioned alongside LAPSUS$ (not attributed)1 CVE in the same articles

These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to LAPSUS$.

CVE-2026-33634Aquasecurity Trivy Embedded Malicious Code VulnerabilityCVSS9.4CriticalExploited1.8%EPSS0articles
Subject articles only

Coverage

44 articles, all timeFull timeline RSS feed
  1. ShinyHunters Suspect Arrested in Jordan as FBI Tightens the NetMalwarebytes
  2. Elsevier Platforms Redirected Users to LAPSUS$ Extortion PagesDataBreaches
  3. Grafana says hackers stole source code after GitHub token breachSecurity Affairs
  4. Grafana Confirms Breach After Hackers Claim They Stole DataSecurityWeek
  5. Malicious Checkmarx Jenkins Plugin Found in Supply Chain AttackSecurityWeek
  6. RansomHouse claims Trellix breach, posts service screenshotsSecurityWeek
  7. Hackers breach Trellix source code repo, law enforcement notifiedSecurityWeek
  8. Checkmarx Confirms Data Theft After Trivy Supply Chain BreachSecurityWeek
  9. Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 AttackThe Hacker News
  10. ShinyHunters leak Rockstar data via third party cloud breachSecurity Affairs
  11. TeamPCP supply chain breach hits Mercor and EU Commission cloudsDark Reading
  12. Mercor Hit by LiteLLM Supply Chain AttackSecurityWeek

The latest 12 are listed. See all 44 articles in the timeline.

Research reports

Related actors

Learn more

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device