Threat actor · all actors
LAPSUSMISP-d9e5be22 unknown
aka LAPSUS$, DEV-0537, SLIPPY SPIDER, Strawberry Tempest, UNC3661
Last updated: 2026-06-01
2attributed CVEs
0ATT&CK techniques
5.9IDF score (tooling uniqueness)
0exclusive CVEs
2020–2022years active
About this actor
An actor group conducting large-scale social engineering and extortion campaign against multiple organizations with some seeing evidence of destructive elements.
Source: MISP threat-actor catalog
Activity timeline
Find actors who…
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2020-1472 KEV | 8.8 | 5.5 | 0.9438 | 2020-08-17 | linuxapplicationmicrosoft |
CVE-2022-24521 KEV | 4.0 | 7.8 | 0.0763 | 2022-04-15 | microsoft |
Not tracked in MITRE ATT&CK (this actor has no technique associations in the STIX bundle).
Top mitigating NIST 800-53 controls (by ATT&CK technique coverage)
No mitigating-control coverage computed — actor has no MITRE ATT&CK techniques on file.
Co-occurring actors
- RomCom 2 shared CVEs
- Void Rabisu 2 shared CVEs
- menuPass 1 shared CVE
- APT28 1 shared CVE
- Equation 1 shared CVE
- Sandworm Team 1 shared CVE
- TeamSpy Crew 1 shared CVE
- Clop 1 shared CVE
- APT3 1 shared CVE
- Winnti Group 1 shared CVE
Similar actors
Overlapping CVEs
- Void Rabisu 1.00
- RomCom 1.00
- Wizard Spider 0.25
- Saint Bear 0.17
- TeamSpy Crew 0.17
Active in same years
- APT1 3.00
- APT28 3.00
- Deep Panda 3.00
- Darkhotel 3.00
- APT29 3.00