Loading story…
Threat intelligence reporting warned that victims of Scattered Lapsus$ Hunters—a The Com-linked extortion operation also using names such as ShinyHunters and SLSH—should not negotiate or pay, citing a pattern of escalating coercion and unreliable promises to delete or return stolen data. The campaign is characterized as data-theft extortion without encryption, where attackers threaten public leaks while simultaneously applying pressure through media manipulation and aggressive outreach designed to overwhelm incident response and executive decision-making.
Unit 221B described harassment tactics used to intensify negotiations and reputational damage, including DDoS, email/SMS flooding, and swatting, alongside threats that can extend to physical intimidation of executives and families. Reporting also noted the group’s tendency to contact journalists to amplify pressure and create negative PR during active incidents, and assessed the operation as volatile and internally conflicted—behavior that can increase risk to victims while limiting the group’s operational discipline. The recommended focus for impacted organizations is containment, remediation, and stakeholder notification, recognizing that once data is stolen, payment does not “un-breach” it.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Unit 221B researchers, including Allison Nixon, warned that negotiating with 'Scattered Lapsus$ Hunters' is likely to escalate extortion into harassment and does not reliably result in deletion or return of stolen data. The warning also highlighted threats of DDoS and physical violence against executives and their families, and described the group as part of 'The Com.'
Unit 221B published an analysis describing an ongoing wave of incidents tied to actors in 'The Com' using names including 'ShinyHunters,' 'Scattered Lapsus Hunters,' and 'SLSH.' The report said the group often steals data without deploying encryption and pressures victims with leak threats, swatting, DDoS, message flooding, and threats against employees and families.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Scattered Lapsus$ Hunters (SLSH), a cybercrime collective formed from members of Scattered Spider, Lapsus$, and ShinyHunters, announced a temporary retreat from online activity after the FBI seized their clearweb site. The group, known for its Western and English-speaking membership, issued a series of aggressive messages on Telegram, vowing to retaliate against the FBI and promising a return in 2026. This announcement followed a period of heightened law enforcement scrutiny, including the arrest and charging of two teenagers in the UK for their alleged involvement in attacks attributed to Scattered Spider, a component of SLSH. The group has a history of dramatic exits and returns, having previously declared a hiatus only to reappear days later. SLSH has gained notoriety for targeting large organizations and for the scale of its operations. In parallel with their public threats, the group claimed responsibility for a massive data breach affecting 39 major companies worldwide, exploiting a Salesforce vulnerability to steal 989 million records. They demanded negotiations with Salesforce and the affected firms, threatening to release the data if ignored. When their demands were unmet, SLSH published data allegedly belonging to six companies, including Qantas Airways, Vietnam Airlines, Fujifilm, GAP Inc., Engie Resources, and Albertsons Companies. The leaked datasets reportedly contain extensive personally identifiable information (PII), such as full names, addresses, passport numbers, phone numbers, email addresses, and, in the case of Qantas, detailed frequent flyer information and internal business data. The Qantas dataset alone is said to be 153 GB and includes over 5 million records. The authenticity of the data has been partially verified by independent analysis, though only the affected companies can fully confirm the breach. The exposure of such sensitive information poses significant risks for identity theft, fraud, and targeted attacks against both individuals and organizations. The SLSH collective's actions have prompted calls for increased vigilance and improved cybersecurity measures among large enterprises, especially those using cloud-based platforms like Salesforce. Law enforcement agencies continue to investigate and pursue members of the group, while the cybersecurity community monitors for further developments and potential retaliatory actions promised by SLSH upon their return.
Jun 29, 2026
A new cybercrime supergroup known as Scattered LAPSUS$ Hunters has emerged in 2025, combining the capabilities and tactics of three notorious threat actors: Scattered Spider, LAPSUS$, and ShinyHunters. This alliance marks a significant escalation in the threat landscape, as the group leverages a blend of social engineering, technical attacks, and public extortion to target high-value enterprise environments. The group is known for its multi-phase assaults, which often begin with sophisticated social engineering techniques such as phone-based vishing to gain initial access, particularly by targeting help desks and exploiting human vulnerabilities. Once inside, the attackers employ insider recruitment, source code theft, and large-scale data exfiltration, drawing on the distinct strengths of each constituent group. Scattered LAPSUS$ Hunters have focused their attacks on major SaaS platforms, including Salesforce, as well as enterprise applications from Oracle and SAP. Their victim list includes prominent organizations across retail, aviation, insurance, and automotive sectors, with named targets such as Home Depot, Marriott, the National Bank of Canada, and Tata Motors' Jaguar Land Rover. The group’s operations are characterized by unpredictability and a willingness to disrupt major businesses, often causing significant operational and reputational damage. Unlike traditional ransomware groups, Scattered LAPSUS$ Hunters do not limit themselves to endpoint infections and ransom demands; they also engage in ransoming stolen data and public extortion campaigns. The group’s members, reportedly including Western teenagers with substantial cryptocurrency holdings, operate with little regard for the consequences of their actions, further complicating law enforcement efforts. Their tactics reflect a shift from the previously dominant Russian ransomware model to a more chaotic, opportunistic approach. The group’s emergence from the cybercrime community known as The Com highlights the evolving nature of cybercriminal alliances and the increasing sophistication of their playbooks. Security experts have noted that the group’s attacks are not only technically advanced but also highly adaptive, making them particularly challenging to defend against. Organizations are advised to strengthen their social engineering defenses, monitor for insider threats, and enhance detection capabilities for unusual access patterns. The rise of Scattered LAPSUS$ Hunters underscores the need for a holistic security posture that addresses both technical and human vulnerabilities. Their activities in 2025 have set a new benchmark for the scale and impact of cybercrime supergroups, prompting urgent calls for improved cross-sector collaboration and intelligence sharing.
Jun 29, 2026
The Scattered Lapsus$ Hunters threat group has re-emerged after a period of inactivity, unveiling a new Ransomware-as-a-Service (RaaS) platform called ShinySp1d3r. This platform is reportedly a collaboration involving operators from ShinyHunters, Scattered Spider, and Lapsus$, and marks a shift in the group’s tactics toward structured insider recruitment and commission-based access deals. The group is actively seeking insiders from large organizations, particularly those with annual revenues over $500 million, and is excluding targets in Russia, China, North Korea, Belarus, and the healthcare sector. Recruitment efforts are focused on individuals who can provide privileged access to corporate systems, with tiered commissions for different types of access, and the group is leveraging underground forums and Telegram channels to coordinate these activities. Simultaneously, security researchers have been monitoring and countering the group’s activities. Resecurity deployed a honeypot that successfully engaged members of the Scattered Lapsus$ Hunters, leading to the exposure of internal communications and operational details. These communications revealed ongoing harassment campaigns against U.S. government officials and connections to high-profile breaches, such as the Snowflake incident, which impacted at least 160 organizations. The group’s renewed operations and aggressive insider recruitment strategy represent a significant escalation in their threat profile, with implications for a wide range of industries and government entities.
Jun 29, 2026