Ransomware.live: lapsus$

| Active

Lapsus$ is an internationally composed data extortion group most active from mid-2021 through 2022, executing high-profile breaches against Microsoft, Nvidia, Samsung, Okta, and Uber by stealing source code and threatening leaks rather than encrypting files; several members — predominantly teenagers — were arrested in the UK.

Victims

First Discovered

2021-12-10

victim

Last Discovered

2026-06-23

victim

Inactive Since

days

Avg Delay

18.6

days

Infostealer

94.7%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months

Exclusive interview with the ransomware group lapsus$ from the CyberSecurityIL Telegram Channel — ransomware-interviews.base44.app

Known Locations (4)

Title	Available	Last Visit	Server Info	FQDN
Origin DNS error \| lapsus.cz \| Cloudflare	No	2026-04-28T07:24:28		`lapsus.cz`
LAPSUS$ \| DATA REPOSITORY	No	2026-07-08T11:35:06		`lapsus.by`
Directory listing for /	No	2026-07-11T17:36:20		`mwojud552brg7rl3obqjvv2funhwpg6acdsuuoeytq7365kmaeoi4gqd.onion`
Announcement	Yes	2026-07-28T13:47:26	ddos-guard	`lapsus.bz`

Target

Heatmap

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
ADExplorer	AnyDesk	placeholder	Mimikatz	placeholder	placeholder	NTDS Utility (ntdsutil)	placeholder

TTPs Matrix (13)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Stealth	Credential Access	Discovery	Collection	Command and Control	Impact	Resource Development	Reconnaissance	Defense Impairment
Valid Accounts	User Execution	Valid Accounts	Exploitation for Privilege Escalation	Valid Accounts	OS Credential Dumping: NTDS	Permission Groups Discovery: Domain Groups	Data from Local System	Proxy	Data Destruction	Acquire Infrastructure: Virtual Private Server	Gather Victim Identity Information	Modify Cloud Compute Infrastructure: Create Cloud Instance
Valid Accounts: Cloud Accounts		Valid Accounts: Cloud Accounts	Valid Accounts	Valid Accounts: Cloud Accounts	OS Credential Dumping: DCSync	Account Discovery: Domain Account	Email Collection: Email Forwarding Rule		Service Stop	Compromise Infrastructure: DNS Server	Gather Victim Identity Information: Credentials	Modify Cloud Compute Infrastructure: Delete Cloud Instance
External Remote Services		Account Manipulation: Additional Cloud Roles	Valid Accounts: Cloud Accounts	Social Engineering: Impersonation	Multi-Factor Authentication Interception		Data from Information Repositories: Confluence		Account Access Removal	Compromise Accounts: Email Accounts	Gather Victim Identity Information: Email Addresses
Trusted Relationship		External Remote Services	Account Manipulation: Additional Cloud Roles		Unsecured Credentials: Chat Messages		Data from Information Repositories: Sharepoint			Obtain Capabilities: Malware	Gather Victim Org Information: Business Relationships
		Create Account: Cloud Account			Credentials from Password Stores: Credentials from Web Browsers		Data from Information Repositories: Code Repositories			Obtain Capabilities: Tool	Gather Victim Org Information: Identify Roles
					Credentials from Password Stores: Password Managers		Data from Information Repositories: Messaging Applications				Search Open Websites/Domains: Code Repositories
					Multi-Factor Authentication Request Generation						Search Closed Sources: Purchase Technical Data
											Phishing for Information: Spearphishing Voice

YARA Rules (1)

Indicators of Compromise (IoCs) (1)

Hash SHA256 1

Type	IOC
`Hash SHA256`	`bdcb86e57332cc0b98c9f86456c4d014f6cf9ff96c21287af25046dc9dff8fa5`