Loading story…
Scattered LAPSUS$ Hunters 4.0 announced a dramatic 'farewell' on September 11, 2025, only to resurface hours later with claims and screenshots suggesting access to sensitive law enforcement and corporate portals. The group’s tactics blend fact and spectacle, aiming to manipulate perception and undermine trust in law enforcement and corporate security. Their actions highlight the increasing use of psychological operations and narrative control by cybercriminal collectives.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
404 Media reported that Scattered LAPSUS$ Hunters exposed apparent phone numbers and home addresses of hundreds of DHS, ICE, FBI, and DOJ officials. The leaked data reportedly included nearly 700 officials from the Department of Homeland Security.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
404media.co
Open sourcescworld.com
Open sourceforesiet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Scattered LAPSUS$ Hunters hacking collective, linked to high-profile attacks on Jaguar Land Rover, Google, and others, has publicly declared it is 'going dark.' The group claims its objectives are fulfilled and future data leaks will be the result of prior campaigns, not ongoing activity. Security experts remain skeptical, suggesting the announcement is likely a tactical retreat due to increased law enforcement pressure and internal discord.
Jun 29, 2026Scattered Lapsus$ Hunters, a cybercrime group linked to Scattered Spider, ShinyHunters, and LAPSUS$, created a fraudulent account in Google's Law Enforcement Request System (LERS), but Google reports no data was accessed. The group also claimed access to the FBI's background check system and announced their 'retirement' on BreachForums, though experts remain skeptical. Evidence suggests the group or its affiliates continue to conduct sophisticated attacks, including recent incidents targeting financial services and major corporations.
Jun 29, 2026
A new cybercrime supergroup known as Scattered LAPSUS$ Hunters has emerged in 2025, combining the capabilities and tactics of three notorious threat actors: Scattered Spider, LAPSUS$, and ShinyHunters. This alliance marks a significant escalation in the threat landscape, as the group leverages a blend of social engineering, technical attacks, and public extortion to target high-value enterprise environments. The group is known for its multi-phase assaults, which often begin with sophisticated social engineering techniques such as phone-based vishing to gain initial access, particularly by targeting help desks and exploiting human vulnerabilities. Once inside, the attackers employ insider recruitment, source code theft, and large-scale data exfiltration, drawing on the distinct strengths of each constituent group. Scattered LAPSUS$ Hunters have focused their attacks on major SaaS platforms, including Salesforce, as well as enterprise applications from Oracle and SAP. Their victim list includes prominent organizations across retail, aviation, insurance, and automotive sectors, with named targets such as Home Depot, Marriott, the National Bank of Canada, and Tata Motors' Jaguar Land Rover. The group’s operations are characterized by unpredictability and a willingness to disrupt major businesses, often causing significant operational and reputational damage. Unlike traditional ransomware groups, Scattered LAPSUS$ Hunters do not limit themselves to endpoint infections and ransom demands; they also engage in ransoming stolen data and public extortion campaigns. The group’s members, reportedly including Western teenagers with substantial cryptocurrency holdings, operate with little regard for the consequences of their actions, further complicating law enforcement efforts. Their tactics reflect a shift from the previously dominant Russian ransomware model to a more chaotic, opportunistic approach. The group’s emergence from the cybercrime community known as The Com highlights the evolving nature of cybercriminal alliances and the increasing sophistication of their playbooks. Security experts have noted that the group’s attacks are not only technically advanced but also highly adaptive, making them particularly challenging to defend against. Organizations are advised to strengthen their social engineering defenses, monitor for insider threats, and enhance detection capabilities for unusual access patterns. The rise of Scattered LAPSUS$ Hunters underscores the need for a holistic security posture that addresses both technical and human vulnerabilities. Their activities in 2025 have set a new benchmark for the scale and impact of cybercrime supergroups, prompting urgent calls for improved cross-sector collaboration and intelligence sharing.
Jun 29, 2026