Threat Brief: Lapsus$ Group
Summary: Unit 42 reports that the Lapsus$ Group grew in a few months from a handful of destructive attacks to stealing and publishing source code from multiple top-tier technology companies, without deploying ransomware or, in most cases, extorting victims. The group gains access through stolen credentials and social engineering, including soliciting employee logins on Telegram across telecom, software, gaming, hosting and call center industries, and in some attacks has wiped cloud systems and destroyed over a thousand virtual machines.
Why it matters: Lapsus$ operates with no malware and no unique TTPs, so there is no single detection to build - and a purchased credential lets the actor work inside your network with the same privileges as the employee, which means your controls have to catch an insider rather than an intruder.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026