Loading story…
The Scattered LAPSUS$ Hunters hacking collective, linked to high-profile attacks on Jaguar Land Rover, Google, and others, has publicly declared it is 'going dark.' The group claims its objectives are fulfilled and future data leaks will be the result of prior campaigns, not ongoing activity. Security experts remain skeptical, suggesting the announcement is likely a tactical retreat due to increased law enforcement pressure and internal discord.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
12 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcedatabreaches.net
Open sourcebankinfosecurity.com
Open sourcehackread.com
Open sourcedatabreaches.net
Open sourceen.wikipedia.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Scattered Lapsus$ Hunters, a cybercrime group linked to Scattered Spider, ShinyHunters, and LAPSUS$, created a fraudulent account in Google's Law Enforcement Request System (LERS), but Google reports no data was accessed. The group also claimed access to the FBI's background check system and announced their 'retirement' on BreachForums, though experts remain skeptical. Evidence suggests the group or its affiliates continue to conduct sophisticated attacks, including recent incidents targeting financial services and major corporations.
Jun 29, 2026Scattered LAPSUS$ Hunters 4.0 announced a dramatic 'farewell' on September 11, 2025, only to resurface hours later with claims and screenshots suggesting access to sensitive law enforcement and corporate portals. The group’s tactics blend fact and spectacle, aiming to manipulate perception and undermine trust in law enforcement and corporate security. Their actions highlight the increasing use of psychological operations and narrative control by cybercriminal collectives.
Jun 29, 2026
The Scattered Lapsus$ Hunters (SLSH), a cybercrime collective formed from members of Scattered Spider, Lapsus$, and ShinyHunters, announced a temporary retreat from online activity after the FBI seized their clearweb site. The group, known for its Western and English-speaking membership, issued a series of aggressive messages on Telegram, vowing to retaliate against the FBI and promising a return in 2026. This announcement followed a period of heightened law enforcement scrutiny, including the arrest and charging of two teenagers in the UK for their alleged involvement in attacks attributed to Scattered Spider, a component of SLSH. The group has a history of dramatic exits and returns, having previously declared a hiatus only to reappear days later. SLSH has gained notoriety for targeting large organizations and for the scale of its operations. In parallel with their public threats, the group claimed responsibility for a massive data breach affecting 39 major companies worldwide, exploiting a Salesforce vulnerability to steal 989 million records. They demanded negotiations with Salesforce and the affected firms, threatening to release the data if ignored. When their demands were unmet, SLSH published data allegedly belonging to six companies, including Qantas Airways, Vietnam Airlines, Fujifilm, GAP Inc., Engie Resources, and Albertsons Companies. The leaked datasets reportedly contain extensive personally identifiable information (PII), such as full names, addresses, passport numbers, phone numbers, email addresses, and, in the case of Qantas, detailed frequent flyer information and internal business data. The Qantas dataset alone is said to be 153 GB and includes over 5 million records. The authenticity of the data has been partially verified by independent analysis, though only the affected companies can fully confirm the breach. The exposure of such sensitive information poses significant risks for identity theft, fraud, and targeted attacks against both individuals and organizations. The SLSH collective's actions have prompted calls for increased vigilance and improved cybersecurity measures among large enterprises, especially those using cloud-based platforms like Salesforce. Law enforcement agencies continue to investigate and pursue members of the group, while the cybersecurity community monitors for further developments and potential retaliatory actions promised by SLSH upon their return.
Jun 29, 2026