LAPSUSThreat actor

“Russia arrests DataSuckers hacking group: Russian authorities have arrested three members of DataSuckers, a Lapsus and ShinyHunters-like hacking and data extortion group operating across the former Soviet space.”

“Russian authorities have arrested three members of DataSuckers, a Lapsus and ShinyHunters-like hacking and data extortion group operating across the former Soviet space.”

““I've seen Scattered Spider, I've seen ShinyHunters, I've seen Lapsus$.” For what it's worth, ShinyHunters claimed in an exclusive interview with The Register that they “don't attack human beings.” They did, however, admit that “there are times in the work we do sometimes we have…”

“‍An attacker claiming to be part of Lapsus$ bought the corporate credentials of an external contractor on the dark web.”

“Furthermore, the LAPSUS$ Group’s announcement of its return, the emergence of Montage, and the trading of access credentials and recruitment efforts on PwnForums and T1ER0NE demonstrate the need for continuous monitoring of Initial Breach asset trading and trends among new groups…”

“…techniques have been repeatedly leveraged by other data extortion cybercriminals, such as FulcrumeSec, ExfilSquad, Scattered Spider, and Lapsus$, to target UK organizations over the last couple years.”

“…ording to security blogger Brian Krebs, Khader (who goes by the nickname ‘Rey’), was the technical operator and public face of Scattered LAPSUS$ Hunters, which he said was an amalgamation of three groups: Scattered Spider, LAPSUS$ and ShinyHunters.”

“Krebs described Khader as the “technical operator and public face” of Scattered LAPSUS$ Hunters.”

“…port published in November 2025, independent security journalist Brian Krebs labeled him as one of the three administrators of Scattered LAPSUS$ Hunters (SLH or SLSH), a group that's assessed to be an amalgamation of Scattered Spider, LAPSUS$, and ShinyHunters.”

“…cybercrime group called ScatteredLapsussHunters (SLSH), which experts say is an amalgamation of three hacking groups — Scattered Spider, LAPSUS$ and ShinyHunters.””

“…cybercrime group called ScatteredLapsussHunters (SLSH), which experts say is an amalgamation of three hacking groups — Scattered Spider, LAPSUS$ and ShinyHunters.”

“Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page”

“We assess with high-confidence their link with "The Com", the broader cybercrime community that also includes Scattered Spider and Lapsus$, an association that became explicit in 2025 with the formation of Scattered Lapsus$ Hunters.”

“…d being part of “The Com,” a loosely organized cybercrime community associated with actors linked to groups such as Scattered Spider and Lapsus$.”

“Academic publisher Elsevier hit by LAPSUS$ redirect attack”

“…am Canada DarkWeb DataBreach DataLeak DDW DeepWeb 랜섬웨어 데이터유출 데이터탈취 독일 개인정보유출 개인정보탈취 공공 대한민국 국방 딥웹 다크웹 Germany 운송 정부기관 캐나다 항공 아르헨티나 Korea Lapsus Leaked Ransom Ransomware SouthKorea TheGentlemen”

“…h UNC6780 established initial access then handed the access off to a separate threat actor who subsequently issued a ransom demand using LAPSUS branding.”

“The Lapsus$ extortion group claiming to have permanently sold the entirety of Mercor’s biometric, PII, and AI training data to Chinese enterprises.”

“A website claiming to be LAPSUS$ declared a permanent cessation of activities, citing the achievement of its financial goals.”

“Group-IB Threat Intelligence team detected multiple mentions in Telegram channels and darkweb forums, including LAPSUS, KelvinSec chats and major cybercrime communities such as Exploit, XSS.”