ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Threat actors

G1004threat actor

LAPSUS$

a.k.a. DEV-0537, Strawberry Tempest

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.

MITRE ATT&CK ↗

Linked entities · 24

usesT1589Gather Victim Identity Information usesT1005Data from Local System usesT1069.002Domain Groups usesT1213.001Confluence usesT1588.002Tool usesT1485Data Destruction usesT1213.003Code Repositories usesT1213.002Sharepoint usesT1583.003Virtual Private Server usesT1591.004Identify Roles usesT1090Proxy usesT1087.002Domain Account usesT1133External Remote Services usesT1078Valid Accounts usesT1588.001Malware usesT1598.004Spearphishing Voice usesT1204User Execution usesT1552.008Chat Messages usesT1489Service Stop usesT1593.003Code Repositories usesT1136.003Cloud Account usesT1114.003Email Forwarding Rule usesT1591.002Business Relationships usesS0002Mimikatz