Unveiling the Tactics of Lapsus$: A Review of Internal Attacks Vectors, Mobile Device Exploitation, and Social Engineering Techniques

The DHS Cyber Safety Review Board reviewed Lapsus$ activity from late 2021 through 2022 and found a group of juveniles used simple but effective social-engineering techniques—spear-phishing, smishing, vishing, and MFA fatigue—to steal credentials, exfiltrate source code, extort dozens of major companies and government agencies, and deface sites; the report emphasizes failures in identity and access management, the risks of SMS/voice-based MFA, and recommends stronger controls and mobile-focused defenses while the document also includes Zimperium MTD marketing as a mitigation option.