Loading story…
A new ransomware collective known as Trinity of Chaos, comprising the notorious threat groups Lapsus$, Scattered Spider, and ShinyHunters, has launched a data leak site on the TOR network, showcasing sensitive data allegedly stolen from 39 major organizations. The group claims to specialize in high-value corporate data acquisition and strategic breach operations, targeting a wide range of sectors including automotive, financial, insurance, technology, telecommunications, and more. Among the high-profile victims named are Google, Cisco, Stellantis, Toyota, FedEx, Disney, Marriott, McDonald’s, Qantas, Pandora, and Air France. The collective has also taken responsibility for the alleged theft of one billion Salesforce records, highlighting the scale and ambition of their operations. The group first emerged in August 2025, coordinating their activities and marketing a new ransomware-as-a-service (RaaS) offering called “shinysp1d3r” via a Telegram channel, which was later banned. According to security researchers, Scattered Spider provided initial access to targets, while ShinyHunters managed data exfiltration and public dumps, with Lapsus$ members actively participating in the campaigns. The leak site has published data samples including contact information and order details from Dell customers, full names and addresses from Telstra customers, and personally identifiable information from Kuwait Airways passengers. Other telecommunications firms such as Verizon, True Corporation & dtac, and Lycamobile have also been listed as victims, raising concerns about the potential for identity theft and social engineering attacks. The exposure of such sensitive data across multiple industries significantly increases the risk of downstream attacks, including phishing, fraud, and targeted scams. Security researchers have warned that the scale of the leaks could have far-reaching consequences for both individuals and organizations, especially given the diversity of the affected sectors. The Trinity of Chaos collective has demonstrated a high level of coordination and technical sophistication, leveraging the strengths of its constituent groups to maximize impact. The group’s public-facing leak site serves both as a tool for extortion and as a marketing platform for their RaaS offering. The inclusion of data from major global brands underscores the group’s reach and the potential for widespread reputational and financial damage. The collective’s activities have prompted urgent calls for affected organizations to assess their exposure, notify impacted individuals, and strengthen their security postures. The emergence of Trinity of Chaos marks a significant escalation in the ransomware threat landscape, with the group’s collaborative model likely to inspire similar alliances among other threat actors. Security experts continue to monitor the situation closely, warning that the group’s ongoing campaigns could result in further high-profile breaches and data leaks.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Reporting emerged alleging that multiple international companies had been compromised by a threat actor referred to as Scattered Lapsus$ Hunters. The references provided do not identify a more precise date for the underlying intrusions, so the reporting date is used.
A ransomware collective calling itself Trinity of Chaos launched a data leak site, marking a new public extortion and victim-shaming capability for the group. The available references do not provide a more specific event date beyond the publication day.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A ransomware group known as Scattered Lapsus$ Hunters, also referred to as ShinyHunters, has launched a darkweb data-leak site to pressure victims of a significant Salesforce data breach into paying extortion demands. The group claims to have stolen 1.5 billion Salesforce records from 760 companies that integrated their Salesforce customer relationship management (CRM) software with the Salesloft Drift artificial intelligence chatbot. The leak site, which debuted on a Friday, lists 39 victim organizations, including major brands such as Cisco, Disney, KFC, Ikea, Marriott, McDonald's, Walgreens, Albertsons, and Saks Fifth Avenue. The attackers are demanding separate ransoms from Salesforce itself to prevent the release of data pertaining to the remaining 721 affected companies. Samples of the stolen data published by the group include extensive personally identifiable information (PII), such as names, dates of birth, nationalities, passport numbers, full contact information, and employment histories. Cybersecurity researcher Milivoj Rajić has tested multiple samples of the leaked data and confirmed their validity, indicating the breach is authentic and the data is genuine. Additional compromised data includes shipping information, marketing lead data, customer support case records, chat transcripts, flight details, and car ownership records. The attack specifically targeted organizations that had integrated Salesforce with the Salesloft Drift AI chatbot, suggesting a possible exploitation of integration points or third-party application vulnerabilities. The public exposure of such a large volume of sensitive data significantly increases the risk of identity theft, fraud, and further targeted attacks against both individuals and organizations. The ransomware group’s strategy of publishing a leak site and naming high-profile victims is designed to maximize pressure and reputational damage, thereby increasing the likelihood of ransom payments. The incident highlights the risks associated with third-party integrations in cloud environments, especially when sensitive customer data is involved. Security teams at affected organizations are likely conducting forensic investigations, assessing the scope of the breach, and notifying impacted customers. The breach underscores the importance of robust access controls, regular security assessments of third-party integrations, and rapid incident response capabilities. Salesforce and Salesloft Drift users are advised to review their security configurations and monitor for suspicious activity. The event has drawn significant attention from the cybersecurity community due to the scale of the breach and the high-profile nature of the victims. Organizations are being urged to remain vigilant and to implement additional security measures to protect against similar attacks in the future.
Jun 29, 2026
A cybercrime alliance known as the Trinity of Chaos, comprising the threat groups LAPSUS$, Scattered Spider, and ShinyHunters, has recently disbanded, but intelligence reports indicate that its members are likely to continue their malicious activities. The alliance, also referred to as Scattered Lapsus$ Hunters, was formed to pool resources and expertise among these high-profile cybercriminal groups. Despite the formal dissolution of the collective, ShinyHunters have already claimed responsibility for new attacks targeting the financial services sector, demonstrating that the threat from these actors remains active. Security researchers from Resecurity and ReliaQuest have observed similar intrusion patterns attributed to Scattered Spider, suggesting ongoing operations by former alliance members. The groups involved in the Trinity of Chaos have previously been linked to significant breaches affecting major organizations such as Google, Qantas, and LVMH, which has bolstered their reputation within the cybercriminal ecosystem. Analysts believe that the disbandment is likely a strategic move, allowing the groups to reorganize and rebrand under new identities while evading law enforcement scrutiny. This tactic mirrors previous behavior seen in the cybercrime landscape, such as the Conti ransomware gang's public exit and subsequent reemergence under different names. The alliance's connection to The Com collective further underscores the collaborative nature of modern cybercrime, where threat actors share tools, tactics, and intelligence. Security experts warn that the credibility and experience gained from past high-profile intrusions will make these groups even more formidable as they resurface. The ongoing threat is compounded by the likelihood that these actors will adopt new monikers and operational structures, making detection and attribution more challenging for defenders. The financial services industry remains a primary target, but the groups' history suggests that other sectors could also be at risk. The use of distributed denial-of-service (DDoS) attacks and sophisticated intrusion techniques has been a hallmark of their operations. Organizations are advised to remain vigilant and update their threat models to account for the evolving tactics of these adversaries. The dissolution of the Trinity of Chaos does not signal a reduction in cyber risk; rather, it marks a transition to a new phase of activity by its constituent groups. Intelligence sharing and proactive defense measures are critical to mitigating the impact of future attacks. The cybercrime landscape continues to evolve, with alliances forming and dissolving as threat actors adapt to law enforcement pressure and shifting opportunities. The legacy of the Trinity of Chaos is likely to influence cybercriminal collaboration and operational strategies for the foreseeable future.
Jun 29, 2026
Ransomware operations are increasingly **industrialized**, shifting from simple file encryption to multi-stage extortion that combines **encryption**, **data theft/leak threats**, **DDoS**, and in some cases direct pressure on third parties such as customers, partners, or regulators. This “quadruple extortion” model has been associated with major groups including **ALPHV/BlackCat**, **CL0P**, and **LockBit**, reflecting a broader trend toward scalable, high-tempo campaigns designed to maximize coercion and revenue. At the same time, incident-response reporting indicates some **zero-day-driven, downstream mass data-theft extortion** campaigns—popularized by **CL0P** against widely used file-transfer platforms—are becoming less effective at driving payments, as organizations better understand that paying for “data suppression” does not remove notification obligations or meaningfully reduce litigation and re-extortion risk. Separately, GuidePoint assessed with high confidence that the new “**0APT**” leak site’s claimed victim list is largely **fabricated** (or recycled from other groups) and likely intended to enable opportunistic extortion, re-extortion, or affiliate fraud; organizations named by 0APT were advised to validate impact via concrete indicators (e.g., ransom note, encryption, direct communication) before treating the posting as evidence of compromise.
Jun 29, 2026