Lapsus$
Lapsus$ is a Brazil-attributed ransomware group with a financial motive, tracked by Brandefense. It targets 8 sectors, including Government and Technology, in 12 countries, including the United States and the United Kingdom. It uses 39 MITRE ATT&CK techniques and exploits 1 known CVE.
- DEV-0537
- Strawberry Tempest
- Slippy Spider
- G1004
- Origin
- Brazil
- Techniques
- 39
- Exploited CVEs
- 1
- First seen
- Jan 1, 2021
- Last seen
- Jun 23, 2026
- Record updated
Who They Target.
About Lapsus$.
Lapsus$ is an internationally composed data extortion group most active from mid-2021 through 2022, executing high-profile breaches against Microsoft, Nvidia, Samsung, Okta, and Uber by stealing source code and threatening leaks rather than encrypting files; several members, predominantly teenagers, were arrested in the UK.
Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.