Profile of Lapsus$
|by Alpha Team
Profile of Lapsus$
TLP: AMBER
In the following profile, ZeroFox Intelligence provides an overview on the Lapsus$ threat actor group.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
Lapsus$ is an extortion collective. After compromising a network, Lapsus$ typically, though not exclusively, exfiltrates data that can be leveraged in ransom demands. The group was identified operating in its current form as early as December 2021 following an attack on websites owned by Brazil’s Ministry of Health; however, there is some evidence to suggest entities within the collective may have been operating since as early as July 2021. The group appears to be financially motivated.
Tags: INF TTPs, malware, all industries, global, vulnerability/exploit, threat actor