Loading threat actor…
Scattered Lapsus$ Hunters (SLH or SLSH) is a loosely organized cybercriminal collective focused on enterprise access, data theft, and financially motivated extortion. It is associated with overlapping participants from Scattered Spider, LAPSUS$, and ShinyHunters, rather than a conclusively established merger of those groups. Saif al-Din Khader, known as Rey, has been identified as an administrator, technical operator, and public representative of the collective. The collective recruits access brokers and enterprise insiders, advertising commission-based payments for directory-integrated systems, single sign-on accounts, privileged cloud credentials, and remote-access services. Its advertised targeting prioritizes organizations with annual revenue exceeding approximately $500 million, particularly telecommunications providers, software and gaming companies, cloud and hosting providers, and call-center or business-process outsourcing environments. Geographic priorities include the United States, United Kingdom, Australia, Canada, and France. Its activities combine social engineering, identity-based access, automated data extraction, and public threats to disclose stolen information. Operators have used residential proxies and VPN services to conceal their infrastructure. Scattered Lapsus$ Hunters publicly distributed exploit code targeting enterprise applications, including Oracle E-Business Suite vulnerability CVE-2025-61882 and a SAP NetWeaver exploit chain involving CVE-2025-31324 and CVE-2025-42999. It also announced development of a ransomware-as-a-service platform named ShinySp1d3r; that announcement does not establish operational deployment. The collective claimed responsibility for the disruptive 2025 Jaguar Land Rover incident, although attribution was not conclusively established. Its subsequent claim of compromising Resecurity was disputed by the company, which identified the accessed environment as an isolated honeypot containing synthetic data.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
41 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
The origins of the hostility trace to autumn 2025 during an extortion campaign centered on an Oracle E-Business Suite (EBS) zero-day vulnerability designated as CVE-2025-61882. Threat intelligence tracking revealed that unpatched enterprise Oracle EBS instances were systematically targeted to exfiltrate critical corporate databases from over one hundred corporations.
This maximum severity unrestricted file upload vulnerability allowed attackers to deploy JSP web shells and execute commands remotely via simple HTTP requests, making it accessible even to attackers with limited technical expertise.
CISA on Monday added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) catalog, confirming its exploitation.
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Described as an amalgamation of Scattered Spider, LAPSUS$, and ShinyHunters. Brian Krebs identified the reportedly arrested Saif al-Din Khader, nicknamed Rey, as its technical operator and public face. The article does not separately attribute specific attacks or malware to this combined cluster.
Described by Brian Krebs as an amalgamation of Scattered Spider, LAPSUS$, and ShinyHunters. Reportedly arrested ShinyHunters member Saif al-Din Khader, known as Rey, was identified as its technical operator and public face. No separate campaign or technical activity is attributed to the combined group in the article.
The group is attributed with the late-August 2025 Jaguar Land Rover breach, which disrupted IT systems, halted manufacturing, affected dealer systems and supplier orders, and involved theft of personal payroll data belonging to thousands of employees. Brian Krebs described Khader, an arrested suspected ShinyHunters member known as Rey, as this group's technical operator and public face.
An umbrella hacking group that includes ShinyHunters. The article connects the detained suspect, Saif al-Din Khader, to this broader organization through prior reporting.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.