Loading threat actor…
Scattered LAPSUS$ Hunters (SLH or SLSH) is a financially motivated cybercriminal umbrella operation combining participants and branding associated with Scattered Spider, LAPSUS$, and ShinyHunters. It emerged publicly in August 2025 through Telegram channels used to coordinate threats and publicize forthcoming data leaks. The operation is a loosely organized alliance rather than a single, consistently bounded group; its constituent identities also conduct activity independently. The collective conducts data-theft and extortion campaigns against enterprise and cloud-service environments, including Salesforce. Its techniques include voice phishing, IT-support impersonation, and device-code phishing to obtain unauthorized access and OAuth access and refresh tokens. Its Salesforce-related activity has extended into third-party integrations and supply-chain compromise, enabling data extraction from downstream organizations. Public leak threats and coordinated publicity are central pressure mechanisms. The brand has also been linked to the Sh1nySp1d3r ransomware-as-a-service offering. In October 2025, participants operating under the Scattered LAPSUS$ Hunters banner publicly released an Oracle E-Business Suite proof-of-concept exploit that Oracle confirmed corresponded to an exploit used in Clop's data-theft attacks. This publication does not establish that the collective operated Clop's campaign. The alliance's overlapping membership and changing brands require distinguishing collective operations from attacks attributed only to its constituent groups.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
41 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
“Moreover, researchers have observed the group exploit CVE-2025-61882, a critical Oracle E-Business vulnerability in their intrusions.”
CISA on Monday added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) catalog, confirming its exploitation.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An umbrella hacking group that includes ShinyHunters. The article connects the detained suspect, Saif al-Din Khader, to this broader organization through prior reporting.
Described as a coalition of members of Scattered Spider, LAPSUS$, and ShinyHunters that claimed responsibility for the Jaguar Land Rover breach. Rey reportedly held administrative privileges in its Telegram channels. The article also recounts his earlier, independently unconfirmed claim that he was distancing himself from this coalition and illegal activity.
Mentioned as another group to which the alleged ShinyHunters leader belongs. The article does not attribute any specific attack, malware, or operational technique to this group.
An umbrella operation reportedly associated with detained suspect Saif al-Din Khader and affiliated with ShinyHunters, Lapsus$, and Scattered Spider. The article provides no specific attacks, malware, or techniques attributed directly to this operation.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.