LAPSUS$
LAPSUS$ is a financially motivated cybercrime and extortion actor. Provided aliases include DEV-0537, Lapsus, Slippy Spider, and Strawberry Tempest. The content describes the group using social engineering for initial access, including calling victims’ help desks and impersonating legitimate users with previously gathered information to obtain access to privileged accounts. The content also states that LAPSUS$ claimed responsibility for the cyberattack on Virta Health, listed the company on its data leak site, claimed it had stolen confidential data, and threatened public release unless ransom demands were met. Additional reporting in the content links remnants of LAPSUS$ to broader cybercriminal ecosystems alongside ShinyHunters and Scattered Spider, and describes a 2025 “Scattered LAPSUS$ Hunters (SLH)” federation combining ShinyHunters brand recognition, Scattered Spider social-engineering expertise, and LAPSUS$ aggressive tactics. The content further notes claimed collaboration or partnership references involving TeamPCP and LAPSUS$, including assessment that TeamPCP likely functioned as an initial-access supplier to monetization partners including LAPSUS$.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
18 malware families attributed to this actor across reporting.
13 additional families tracked in Mallory.
Associated vulnerabilities
10 CVEs this actor has used in observed campaigns. 10 of them exploited in the wild.
BleepingComputer reported that threat actors leveraged credentials stolen through the Trivy supply chain compromise (CVE-2026-33634) to breach Cisco's internal development environment... The CISA KEV remediation deadline for CVE-2026-33634 is today, April 8, 2026... Beyond patching Trivy to v0.69.2+, trivy-action to v0.35.0, or setup-trivy to v0.2.6, organizations must also complete credential rotation.
Researchers analyzed leaked scripts used by attackers to exploit CVE-2025-61882 on internet-facing Oracle EBS instances. The exploit uses a crafted request with a return_url to coerce the server into fetching an attacker payload (SSRF), retrieving a malicious XSL with embedded JavaScript executed via Java javax.script, leading to a reverse shell. Mandiant reports exploitation and data theft starting Aug 2025; CISA added it to KEV; Oracle provided fixes and IOCs.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
5 more CVEs tied to this actor tracked in Mallory.
Observables
13 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as remnants within The Com cybercrime network linked by Mandiant to ShinyHunters.
Claimed responsibility for a cyberattack against Virta Health, alleging theft of confidential data and threatening public release unless ransom demands were met.
Referenced only as a criminal affiliate/community link associated with TeamPCP.
Referenced only as a linked affiliate/extortion crew associated with TeamPCP.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.