Loading threat actor…
ScatteredLapsussHunters (SLSH) is a cybercriminal collective described as an amalgamation of actors associated with Scattered Spider, LAPSUS$, and ShinyHunters. The collective has been associated with data theft, credential monetization, social engineering, exploitation of public-facing applications, and extortion. Activity attributed to its ShinyHunters-associated component has included theft of personal and organizational data from telecommunications, government, technology, health care, education, agriculture, and transportation-sector victims. SLSH-associated operators have also been linked to the monetization of credentials obtained through software supply-chain compromises. The group’s operations appear primarily financially motivated, including data-theft-based extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cybercrime collective described as an amalgamation of Scattered Spider, LAPSUS$, and ShinyHunters. It is associated in the reporting with Rey's alleged takeover of the ShinyHunters brand and escalating attacks.
An amalgamated cybercrime grouping associated with the alleged takeover and control dispute involving ShinyHunters. Its alleged member Rey admitted to participation in ransomware attacks and was said to be trying to leave the group.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.