Lapsus Group

The Lapsus Group, identified as a threat actor originating from North Korea, has been involved in various cybercriminal activities, primarily focusing on cryptocurrency theft. This group is known for its use of sophisticated tools such as RedLine and QakBot, which have been instrumental in their operations. According to cybersecurity firm ReliaQuest, the Lapsus Group's activities are persistent and show signs of resurgence. In one notable incident, an employee was subjected to "MFA fatigue" by a hacker from the Lapsus Group, who sent multiple multi-factor authentication notifications to the victim's device. This tactic is indicative of the group's advanced strategies to compromise security measures. Furthermore, the Lapsus Group has shown resilience and adaptability; despite being disbanded in 2022, it managed to revive itself and continue its malicious activities. The threat posed by the Lapsus Group extends to large corporations as well. In the summer of 2022, the group successfully breached a trillion-dollar company using just one compromised credential, demonstrating their ability to infiltrate high-value targets. This event underscores the group's capability to exploit even minor security vulnerabilities to gain access to sensitive information, including source code. The naming conventions for such groups vary across different cybersecurity entities; for instance, CrowdStrike refers to this group as "Scattered Spider," while another name used is SLIPPY SPIDER.