Lapsus$
| Active
Lapsus$ is an internationally composed data extortion group most active from mid-2021 through 2022, executing high-profile breaches against Microsoft, Nvidia, Samsung, Okta, and Uber by stealing source code and threatening leaks rather than encrypting files; several members — predominantly teenagers — were arrested in the UK.
Victims
19
First Discovered
2021-12-10
victim
Last Discovered
2026-05-10
victim
Inactive Since
9
days
Avg Delay
8.2
days
Infostealer
53.3%
victims with domain
Countries
10
hit
Attack Velocity — Last 12 months
Stable vs last month
Known Locations (3)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Origin DNS error | lapsus.cz | Cloudflare | No | 2026-04-28T07:24:28 |
lapsus.cz
|
|||
|
LAPSUS$ | DATA REPOSITORY | Yes | 2026-05-19T16:37:01 | ddos-guard |
lapsus.by
|
||
|
Directory listing for / | Yes | 2026-05-19T16:37:52 | SimpleHTTP 0.6 Python 3.12.3 |
mwojud552brg7rl3obqjvv2funhwpg6acdsuuoeytq7365kmaeoi4gqd.onion
|
Target
Top 5 Activity Sectors
- Technology 5
- Consumer Services 3
- Business Services 2
- Healthcare 2
- Education 2
Top 5 Countries
-
United States
6
-
France
5
-
United Kingdom
1
-
Canada
1
-
Germany
1
Heatmap
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
ADExplorer
|
AnyDesk
|
Mimikatz
|
NTDS Utility (ntdsutil)
|
YARA Rules (1)
Indicators of Compromise (IoCs) (1)
Victims (19)
[AI generated] Salesfloor is a software company that provides a mobile platform designed to connect …
[AI generated] Lille University, also known as University of Lille, is a well-recognized public univ…
[AI generated] The FR Ministry of Agriculture, or the French Ministry of Agriculture, is a governmen…
[AI generated] Eni Energy is an Italian multinational oil and gas company headquartered in Rome. Fou…
