Ransomware Group
Lapsus$
Lapsus$ is an internationally composed data extortion group most active from mid-2021 through 2022, executing high-profile breaches against Microsoft, Nvidia, Samsung, Okta, and Uber by stealing source code and threatening leaks rather than encrypting files; several members — predominantly teenagers — were arrested in the UK.
Known victims25
Threat level
MEDIUM
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
DiscoveryEnum
- ADExplorer
LOLBAS
- NTDS Utility (ntdsutil)
RMM-Tools
- AnyDesk
Known infrastructure
The following Tor hidden services have been associated with this group:
LAPSUS$LAPSUS$ | DATA REPOSITORYDirectory listing for /Origin DNS error | lapsus.cz | Cloudflare
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Lapsus$’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request