Scattered LAPSUS Hunters Insider Incident at CrowdStrike and Ransomware Developments

CrowdStrike confirmed that an insider was terminated after sharing screenshots of internal systems with the Scattered LAPSUS$ Hunters, a cybercrime collective comprising Scattered Spider, LAPSUS$, and ShinyHunters. The threat actors posted these screenshots on Telegram and claimed to have paid the insider $25,000 for access, including SSO authentication cookies, but CrowdStrike detected the activity and shut down access before any customer data was compromised. The company emphasized that its systems were not breached and that law enforcement has been notified.

Meanwhile, the Scattered LAPSUS$ Hunters collective has escalated its operations, launching a new Telegram channel and increasing its public activity. The group, which has a history of social engineering and SaaS supply chain breaches, is also linked to the development of a new ransomware-as-a-service platform called ShinySp1d3r. This RaaS, created by ShinyHunters and Scattered Spider, is being built from scratch and features advanced capabilities, signaling a shift from using third-party ransomware to deploying their own tools in future attacks.