← threat actors
threat actor
LAPSUS
also tracked as apt iran 1, cyberav3ngers 1
2 stories · 0 in the wild · July 23, 2026 – September 10, 2026
evidence: 2 claimed
sectors
- critical infrastructure 1 · Sep 10
- transport 1 · Sep 10
geography
- iran 1 · Sep 10
- united states 1 · Sep 10
what we reported, newest first, grouped by story
September 10, 2026
- LAPSUS$ posted a PGP-signed "Chapter II" message promising a first victim in three days (DarkWebInformer). Separately, APT IRAN, linked to IRGC-affiliated CyberAv3ngers, claimed the 7 September AT&T fiber outage across Houston, Dallas, Fort Worth and Austin plus an unnamed Texas water utility; AT&T says it has found no evidence the outage was an attack (DarkWebInformer).
· Sep 10 · claimed · as apt iran, cyberav3ngers · Malware & Threat Activity
July 23, 2026
- LAPSUS$ claims a permanent shutdown in a PGP-signed post, saying it met its financial objectives and taunting investigators — claims that remain unverified and fit a common pre-rebrand pattern (DailyDarkWeb).
· Jul 23 · claimed · Threat Activity