LAPSUS$

LAPSUS$ was a notorious extortion-focused threat actor that managed to gain access to multiple large organizations and exfiltrate sensitive data and source code throughout 2022. Some members of LAPSUS$ were exposed, and some were also arrested. Known members were located in Brazil and the UK. The group utilized social engineering and SIM swapping to gain initial access to their targets. When targeting cloud environments, LAPSUS$ often made use of compromised credentials, spun up new workloads for staging purposes, and created new admin accounts while locking out existing ones. LAPSUS$ also exploited vulnerabilities affecting internal servers for privilege escalation, and notably gained access to communication apps in order to monitor their targets' incident response activities and thereby gain leverage in their extortion efforts.