Trusted Design

LAPSUS$

G1004 · MITRE Pageへのリンク

脅威アクターの詳細

[LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.(Citation: BBC LAPSUS Apr 2022)(Citation: MSTIC DEV-0537 Mar 2022)(Citation: UNIT 42 LAPSUS Mar 2022)

別名・別称

LAPSUS$
DEV-0537
Strawberry Tempest

利用した攻撃手法

• T1597.002 - Purchase Technical Data
• T1213.002 - Sharepoint
• T1133 - External Remote Services
• T1489 - Service Stop
• T1087.002 - Domain Account
• T1069.002 - Domain Groups
• T1098.003 - Additional Cloud Roles
• T1555.005 - Password Managers
• T1005 - Data from Local System
• T1586.002 - Email Accounts
• T1589 - Gather Victim Identity Information
• T1555.003 - Credentials from Web Browsers
• T1589.002 - Email Addresses
• T1598.004 - Spearphishing Voice
• T1591.002 - Business Relationships
• T1578.003 - Delete Cloud Instance
• T1593.003 - Code Repositories
• T1090 - Proxy
• T1588.001 - Malware
• T1583.003 - Virtual Private Server
• T1213.001 - Confluence
• T1114.003 - Email Forwarding Rule
• T1204 - User Execution
• T1621 - Multi-Factor Authentication Request Generation
• T1552.008 - Chat Messages
• T1199 - Trusted Relationship
• T1136.003 - Cloud Account
• T1588.002 - Tool
• T1078 - Valid Accounts
• T1068 - Exploitation for Privilege Escalation
• T1531 - Account Access Removal
• T1589.001 - Credentials
• T1584.002 - DNS Server
• T1656 - Impersonation
• T1591.004 - Identify Roles
• T1578.002 - Create Cloud Instance
• T1213.003 - Code Repositories
• T1485 - Data Destruction
• T1111 - Multi-Factor Authentication Interception
• T1003.003 - NTDS
• T1078.004 - Cloud Accounts
• T1003.006 - DCSync
• T1213.005 - Messaging Applications

関連するCVE (攻撃手法に関連)

• CVE-2014-1761 (T1111)
• CVE-2015-1641 (T1213.003)
• CVE-2016-2343 (T1598.004)
• CVE-2016-6532 (T1598.004)
• CVE-2015-3785 (T1213.003)
• CVE-2010-0232 (T1213.003)
• CVE-2013-2595 (T1584.002)
• CVE-2025-24893 (T1213.003)
• CVE-2015-2590 (T1213.003)
• CVE-2012-1258 (T1213.003)
• CVE-2014-3153 (T1213.003)
• CVE-2013-6282 (T1213.003)
• CVE-2015-0310 (T1213.003)
• CVE-2013-7331 (T1003.003)
• CVE-2011-0611 (T1213.003)
• CVE-2025-54313 (T1213.003)
• CVE-2015-2546 (T1213.003)
• CVE-2015-5897 (T1068)
• CVE-2015-3456 (T1213.003)
• CVE-2013-2094 (T1068)
• CVE-2014-4113 (T1111)
• CVE-2015-8562 (T1213.003)
• CVE-2016-1990 (T1213.003)
• CVE-2016-1991 (T1213.003)
• CVE-2015-1701 (T1111)
• CVE-2015-3628 (T1213.003)
• CVE-2015-6034 (T1213.003)
• CVE-2015-6022 (T1213.003)
• CVE-2015-7262 (T1213.003)
• CVE-2016-1562 (T1213.003)
• CVE-2017-0263 (T1213.003)
• CVE-2016-9496 (T1591.004)
• CVE-2012-0056 (T1068)
• CVE-2010-3081 (T1213.003)
• CVE-2015-3636 (T1068)
• CVE-2015-0057 (T1213.003)
• CVE-2015-1761 (T1213.003)
• CVE-2013-3660 (T1213.003)
• CVE-2015-2360 (T1213.003)
• CVE-2014-6324 (T1003.006)
• CVE-2008-1436 (T1213.003)
• CVE-2010-4398 (T1213.003)
• CVE-2014-2273 (T1213.003)
• CVE-2015-2387 (T1213.003)
• CVE-2017-0001 (T1213.003)
• CVE-2025-13335 (T1213.003)
• CVE-2025-13927 (T1213.003)
• CVE-2025-13928 (T1111)
• CVE-2025-68645 (T1213.003)
• CVE-2026-1102 (T1078)
• CVE-2026-20127 (T1213.003)
• CVE-2013-2678 (T1213.003)
• CVE-2017-12149 (T1111)
• CVE-2014-6271 (T1213.003)
• CVE-2014-0329 (T1213.003)
• CVE-2015-2852 (T1598.004)
• CVE-2015-2854 (T1213.003)
• CVE-2015-7755 (T1213.003)
• CVE-2016-1898 (T1213.003)
• CVE-2016-1897 (T1213.003)
• CVE-2016-1287 (T1213.003)
• CVE-2015-6036 (T1213.003)
• CVE-2015-8286 (T1213.003)
• CVE-2015-8287 (T1213.003)
• CVE-2016-9494 (T1591.004)
• CVE-2016-9495 (T1591.004)
• CVE-2017-3212 (T1213.003)
• CVE-2025-55182 (T1213.003)
• CVE-2015-0932 (T1213.003)
• CVE-2014-4322 (T1213.003)
• CVE-2012-0507 (T1111)
• CVE-2014-3393 (T1213.003)
• CVE-2012-6422 (T1656)
• CVE-2025-34026 (T1213.003)
• CVE-2025-55183 (T1213.003)
• CVE-2025-55184 (T1213.003)
• CVE-2026-0723 (T1213.003)
• CVE-2012-3213 (T1213.003)
• CVE-2011-3544 (T1213.003)
• CVE-2013-2465 (T1111)
• CVE-2014-1776 (T1213.003)
• CVE-2012-1723 (T1213.003)
• CVE-2010-1297 (T1213.003)
• CVE-2015-4902 (T1213.003)
• CVE-2015-0311 (T1213.003)
• CVE-2010-0188 (T1213.003)
• CVE-2012-4969 (T1213.003)
• CVE-2016-2342 (T1213.003)
• CVE-2012-4792 (T1213.003)
• CVE-2015-5749 (T1111)
• CVE-2015-6585 (T1213.003)
• CVE-2015-0336 (T1213.003)
• CVE-2012-4681 (T1213.003)
• CVE-2014-4114 (T1213.003)
• CVE-2015-2502 (T1213.003)
• CVE-2014-0322 (T1213.003)
• CVE-2013-2551 (T1204)
• CVE-2015-0071 (T1204)
• CVE-2015-2419 (T1204)
• CVE-2014-8361 (T1213.003)
• CVE-2015-1770 (T1213.003)
• CVE-2014-6352 (T1213.003)
• CVE-2012-1856 (T1003.003)
• CVE-2015-4495 (T1213.003)
• CVE-2015-7808 (T1068)
• CVE-2016-1019 (T1213.003)
• CVE-2015-0016 (T1213.003)
• CVE-2010-0738 (T1111)
• CVE-2011-1255 (T1003.003)
• CVE-2023-1389 (T1213.003)
• CVE-2025-31125 (T1213.003)
• CVE-2015-5119 (T1213.003)
• CVE-2015-5122 (T1213.003)
• CVE-2015-7645 (T1213.003)
• CVE-2015-3043 (T1213.003)
• CVE-2015-3090 (T1213.003)
• CVE-2010-1553 (T1068)
• CVE-2015-3113 (T1213.003)
• CVE-2016-1010 (T1213.003)
• CVE-2016-0984 (T1213.003)
• CVE-2016-0998 (T1213.003)
• CVE-2015-0313 (T1213.003)
• CVE-2015-0359 (T1213.003)
• CVE-2015-5130 (T1213.003)
• CVE-2015-5134 (T1213.003)
• CVE-2015-5539 (T1213.003)
• CVE-2015-5557 (T1213.003)
• CVE-2015-5563 (T1213.003)
• CVE-2015-5559 (T1213.003)
• CVE-2015-5540 (T1213.003)
• CVE-2015-5561 (T1213.003)
• CVE-2015-5551 (T1213.003)
• CVE-2015-5564 (T1213.003)
• CVE-2015-5565 (T1213.003)
• CVE-2015-5550 (T1213.003)
• CVE-2015-5566 (T1213.003)
• CVE-2015-5127 (T1213.003)
• CVE-2015-5556 (T1213.003)
• CVE-2017-0261 (T1213.003)
• CVE-2017-0262 (T1213.003)
• CVE-2010-2884 (T1213.003)
• CVE-2012-0611 (T1068)
• CVE-2013-0634 (T1213.003)
• CVE-2013-0641 (T1213.003)
• CVE-2013-0640 (T1213.003)
• CVE-2014-0569 (T1213.003)
• CVE-2015-5560 (T1213.003)
• CVE-2014-8439 (T1213.003)
• CVE-2015-3105 (T1213.003)
• CVE-2014-0497 (T1213.003)
• CVE-2013-0074 (T1656)
• CVE-2014-0556 (T1213.003)
• CVE-2014-8440 (T1213.003)
• CVE-2017-0143 (T1213.003)
• CVE-2017-17215 (T1213.003)
• CVE-2014-7911 (T1213.003)
• CVE-2015-2545 (T1213.003)
• CVE-2014-6332 (T1111)
• CVE-2017-0199 (T1213.003)
• CVE-2015-2424 (T1213.003)
• CVE-2015-0097 (T1213.003)
• CVE-2012-0158 (T1003.003)
• CVE-2016-1001 (T1213.003)
• CVE-2015-2853 (T1213.003)
• CVE-2015-7261 (T1213.003)
• CVE-2013-3906 (T1213.003)
• CVE-2010-3333 (T1213.003)
• CVE-2017-16929 (T1213.003)
• CVE-2014-0515 (T1213.003)
• CVE-2012-2539 (T1213.003)
• CVE-2014-9163 (T1213.003)
• CVE-2010-0806 (T1213.003)
• CVE-2014-4148 (T1213.003)
• CVE-2011-3402 (T1213.003)
• CVE-2010-2883 (T1213.003)
• CVE-2014-7247 (T1213.003)
• CVE-2015-2426 (T1213.003)
• CVE-2014-3897 (T1213.003)
• CVE-2009-3129 (T1213.003)
• CVE-2013-5990 (T1213.003)
• CVE-2017-8570 (T1213.003)
• CVE-2016-4117 (T1213.003)
• CVE-2015-1427 (T1111)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る