LAPSUS__2022__nccgroup_LAPSUS-Recent-TTPs_04-28-2022.pdf

**NCC Group analysis of LAPSUS$ TTPs:** The report summarizes observed LAPSUS$ activity — initial access via stolen SSO cookies and social engineering/insider recruitment, rapid credential harvesting and privilege escalation, lateral movement via RDP and VPN, targeted exfiltration of source code and API keys (often using public file drop services), and disruptive/destructive actions against virtual infrastructure; it provides mitigation recommendations, MITRE ATT&CK mappings and several IOCs.