AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
LAPSUS$
Aliases: DEV-0537, LAPSUS$, Strawberry Tempest
[LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.(Citation: BBC LAPSUS Apr 2022)(Citation: MSTIC DEV-0537 Mar 2022)(Citation: UNIT 42 LAPSUS Mar 2022)
Open interactive actor investigation
ATT&CK techniques
T1003.003T1003.006T1005T1068T1069.002T1078T1078.004T1087.002T1090T1098.003T1111T1114.003T1133T1136.003T1199T1204T1213.001T1213.002T1213.003T1213.005T1485T1489T1531T1552.008T1555.003T1555.005T1578.002T1578.003T1583.003T1584.002T1586.002T1588.001T1588.002T1589T1589.001T1589.002T1591.002T1591.004T1593.003T1597.002T1598.004T1621T1684.001
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.003 NTDS simulation — Exact active technique ID
- T1003.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.006 DCSync simulation — Exact active technique ID
- T1003.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1068 Exploitation for Privilege Escalation simulation — Exact active technique ID
- T1068 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069.002 Domain Groups simulation — Exact active technique ID
- T1069.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090 Proxy simulation — Exact active technique ID
- T1090 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098.003 Additional Cloud Roles simulation — Exact active technique ID
- T1098.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1111 Multi-Factor Authentication Interception simulation — Exact active technique ID
- T1111 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1114.003 Email Forwarding Rule simulation — Exact active technique ID
- T1114.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1136.003 Cloud Account simulation — Exact active technique ID
- T1136.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1199 Trusted Relationship simulation — Exact active technique ID
- T1199 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204 User Execution simulation — Exact active technique ID
- T1204 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.001 Confluence simulation — Exact active technique ID
- T1213.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.002 Sharepoint simulation — Exact active technique ID
- T1213.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.003 Code Repositories simulation — Exact active technique ID
- T1213.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.005 Messaging Applications simulation — Exact active technique ID
- T1213.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1485 Data Destruction simulation — Exact active technique ID
- T1485 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1489 Service Stop simulation — Exact active technique ID
- T1489 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1531 Account Access Removal simulation — Exact active technique ID
- T1531 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.008 Chat Messages simulation — Exact active technique ID
- T1552.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.003 Credentials from Web Browsers simulation — Exact active technique ID
- T1555.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.005 Password Managers simulation — Exact active technique ID
- T1555.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1578.002 Create Cloud Instance simulation — Exact active technique ID
- T1578.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1578.003 Delete Cloud Instance simulation — Exact active technique ID
- T1578.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.003 Virtual Private Server simulation — Exact active technique ID
- T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.002 DNS Server simulation — Exact active technique ID
- T1584.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.002 Email Accounts simulation — Exact active technique ID
- T1586.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.001 Malware simulation — Exact active technique ID
- T1588.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589 Gather Victim Identity Information simulation — Exact active technique ID
- T1589 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589.001 Credentials simulation — Exact active technique ID
- T1589.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589.002 Email Addresses simulation — Exact active technique ID
- T1589.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1591.002 Business Relationships simulation — Exact active technique ID
- T1591.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1591.004 Identify Roles simulation — Exact active technique ID
- T1591.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1593.003 Code Repositories simulation — Exact active technique ID
- T1593.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1597.002 Purchase Technical Data simulation — Exact active technique ID
- T1597.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598.004 Spearphishing Voice simulation — Exact active technique ID
- T1598.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1621 Multi-Factor Authentication Request Generation simulation — Exact active technique ID
- T1621 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684.001 Impersonation simulation — Exact active technique ID
- T1684.001 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 9 — Identity defense and ITDR
Blue Team & Defensive Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 1 — Mission, authorization, and methodology
Red Team & Offensive Security · explicit-nameModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · explicit-nameModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-nameModule 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 9 — Identity defense and ITDR
Blue Team & Defensive Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 1 — Mission, authorization, and methodology
Red Team & Offensive Security · explicit-nameModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · explicit-nameModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-nameModule 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · explicit-name