Microsoft Incident Response and Microsoft Threat Intelligence published a detailed analysis of DEV-0537 — also tracked as LAPSUS$ and later renamed Strawberry Tempest — a cybercriminal group operating a pure extortion and destruction model without ransomware deployment. Unlike most threat actors who minimize visibility, DEV-0537 publicly announces attacks on social media, actively recruits insider accomplices, and has been observed joining victims' own incident response calls to monitor crisis communications in real time.
Identity-Centric Initial Access: Six Distinct Vectors
DEV-0537's initial access strategy is almost entirely focused on compromising user identities rather than exploiting technical vulnerabilities. The group deploys the Redline password stealer, purchases credentials and session tokens from criminal underground forums, pays employees or contractors at target organizations directly for access and MFA approval, searches public code repositories for exposed credentials, and conducts phone-based social engineering including SIM-swapping attacks to seize control of phone numbers used for MFA. In some cases the group also targets employees' personal email accounts — used as second-factor authentication or password recovery channels — to pivot to corporate access by resetting credentials. For organizations with MFA, DEV-0537 uses session token replay and MFA prompt bombing: triggering repeated simple-approval prompts hoping the legitimate user eventually consents.
Reconnaissance and Privilege Escalation
Once inside, DEV-0537 uses AD Explorer to enumerate all users and groups and identify high-privilege accounts. They search SharePoint, Confluence, JIRA, GitLab, GitHub, Teams, and Slack for exposed credentials and secrets, and exploit unpatched vulnerabilities in internally accessible Confluence, JIRA, and GitLab instances to gain privileged execution context. DCSync attacks and Mimikatz are used for credential dumping, and the built-in ntdsutil utility is used to extract the Active Directory database once domain administrator access is achieved. In several documented cases, DEV-0537 called the organization's help desk impersonating legitimate users — using profile pictures, native-English speakers, and knowledge of personal recovery questions ("first street you lived on," "mother's maiden name") — to social-engineer password resets for privileged accounts.
Exfiltration, Cloud Destruction, and Crisis Monitoring
DEV-0537 operates dedicated infrastructure on VPS providers and uses NordVPN with geographically targeted egress points to evade impossible-travel detections. Exfiltrated data is staged on actor-controlled systems joined to the victim's VPN or Azure AD environment. In cloud-enabled victims, the group creates new virtual machines within the target's AWS or Azure tenant, creates global admin accounts, sets tenant-wide mail transport rules to copy all inbound and outbound email to the new account, and then removes all other global admin accounts — effectively locking the organization out of its own cloud entirely. Post-exfiltration, DEV-0537 deletes on-premises resources (VMware vSphere/ESXi) and cloud resources to trigger incident response, then joins the victim's crisis communication calls (Slack, Teams, conference bridges) to monitor the organization's incident response in real time and time extortion demands accordingly. In some cases victims are extorted to suppress data release; in others, data is published without negotiation.
Confirmed Microsoft Intrusion
DEV-0537 publicly claimed access to Microsoft and exfiltration of source code. Microsoft confirmed a single account was compromised, granting limited access to portions of source code with no customer code or data involved. Microsoft's threat intelligence team was already investigating the compromised account when DEV-0537 made the public announcement, allowing the team to intervene and interrupt the actor mid-operation. The group's TTPs in the Microsoft intrusion were consistent with all techniques described in this analysis.
Defensive Priorities
DEV-0537's identity-centric attack model requires defensive measures mirroring insider threat programs: eliminating telephony-based MFA in favor of FIDO tokens or number-matching authenticators; blocking simple-approval MFA push; implementing risk-based conditional access policies; educating help desk staff on social engineering verification; and establishing out-of-band incident response communication channels that DEV-0537 cannot easily infiltrate. Monitoring for tenant-wide Exchange transport rule creation, Azure AD global admin modifications, and bulk VM creation within cloud tenants provides detection coverage for the group's most destructive post-compromise actions.