LAPSUS$

LAPSUS$ is a financially motivated extortion and intrusion group best known for high-profile compromises of major technology, telecommunications, gaming, and identity-management organizations. The group is widely tracked under aliases including DEV-0537, Slippy Spider, and Strawberry Tempest. Public reporting and law-enforcement actions have linked parts of the group to young, primarily English-speaking operators, including individuals in the United Kingdom, rather than to a nation-state apparatus. LAPSUS$ became notable for aggressive social engineering, rapid smash-and-grab intrusions, public victim shaming, and data-theft extortion. The group has been associated with compromises affecting organizations such as Microsoft, Samsung, Nvidia, Ubisoft, Okta, Globant, and Rockstar Games, and later victim claims have also included additional enterprises in finance, retail, and telecommunications. Some more recent victim claims remain unconfirmed and should be treated cautiously. Operationally, LAPSUS$ has been associated less with bespoke stealth malware than with human-centric intrusion tradecraft. Reported techniques include social engineering of help desks and employees, credential theft and reuse, insider recruitment or bribery, abuse of remote access and identity systems, and exploitation of authentication workflows to obtain privileged access. The group has also been linked to extortion activity involving stolen source code, internal communications, customer data, and other sensitive corporate information. In some incidents, LAPSUS$ publicly advertised stolen data, released samples to pressure victims, or offered access and datasets for sale. The group has shown overlap or interaction with broader cybercriminal ecosystems, including communities associated with The Com and, in some reporting, collaboration or parallel activity involving actors such as TeamPCP, ShinyHunters, and Scattered Spider. These relationships appear opportunistic and criminal rather than indicative of formal centralized command. Reporting has also noted possible reuse of former LAPSUS$ tooling or community infrastructure by adjacent actors. Law-enforcement and court proceedings have tied named individuals associated with LAPSUS$ to intrusions against Nvidia, BT/EE, and Rockstar Games, among others. Arion Kurtaj has been publicly linked to the group in connection with the 2022 Rockstar Games intrusion and GTA 6 leak. Separate UK proceedings have also linked Thalha Jubair to LAPSUS$ in addition to Scattered Spider and The Com. These cases reinforced the assessment that LAPSUS$ functioned as a loose, youth-driven cybercriminal collective centered on social engineering, credential abuse, and extortion rather than a traditional malware-heavy ransomware operation. Overall, LAPSUS$ is best characterized as a high-impact cybercriminal threat actor specializing in socially engineered initial access, theft of sensitive enterprise data, and coercive public extortion against prominent organizations.