Scattered Lapsus HuntersThreat actor
Launched in August 2025, the Scattered LAPSUS$ Hunters collective has rapidly established itself as one of the most formidable threats on today’s cybercriminal landscape. This alliance brings together three of the most notorious English-speaking cybercriminal groups: Scattered Spider, LAPSUS$ and ShinyHunters.From MISP Galaxy
Last reported 19 days ago, by Help Net Security5 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1684Social Engineering
“ShinyHunters is known for vishing, a social engineering tactic in which attackers call employees while posing as IT support staff and trick them into handing over sensitive information.”
- T1195Supply Chain Compromise
“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”
- T1036Masquerading
“Attributed to threat actor idbzoomh, the campaign used a malicious archive masquerading as leaked source code to deliver Vidar v18.7, an information stealer, and GhostSocks, a SOCKS proxy trojan.”
- T1053.005Scheduled Task
“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”
- T1110.004Credential Stuffing
“…ing dozens of companies and selling nearly a billion stolen records from services like MyFitnessPal and Dubsmash, largely through credential-stuffing attacks against developers' GitHub accounts.”
- T1550.002Pass the Hash
“Lateral movement was achieved mostly through RDP with compromised credentials, though other attacks like Pass-the-Hash were also observed.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Detained ShinyHunters hacker reportedly helping FBI track down fellow members“Last year, independent journalist Brian Krebs identified Khader as a key member of Scattered Lapsus$ Hunters, an umbrella group of hackers that included ShinyHunters.”
-
Alleged ShinyHunters Leader Arrested in Jordan“Khader is also a known member of the Scattered Lapsus$ Hunters group.”
-
Cyber Brief 26-02 - January 2026“Regarding data exposure and leaks incidents, cybercrime actor Scattered Lapsus Hunters reportedly exfiltrated 500GB of data from the European Space Agency, and Eurail B.V.”
-
Cyber Brief 26-05 - April 2026“Previous major campaigns were attributed to Russia-linked Storm-2372 and criminal group Scattered Lapsus$ Hunters.”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“…e community that also includes Scattered Spider and Lapsus$, an association that became explicit in 2025 with the formation of Scattered Lapsus$ Hunters.”
Indicators in its reports
named in the reports above- fbijobs[.]govin 1 report
- security[.]orgin 1 report
- azurenetfiles[.]netin 1 report
- 142.11.200[.]186in 1 report
- politie[.]nlin 1 report
- secure[.]comin 1 report
- promo[.]comin 1 report
- raidforums[.]comin 1 report
- rf[.]wsin 1 report
- raid[.]lolin 1 report
- breachforums[.]stin 1 report
- breachforums[.]hnin 1 report
- task[.]namein 1 report
- fa210f015399de16…94972a3bdc43in 1 report
- d5efdf6f35e9c6ed…3d591b94e384in 1 report
- a4e525d8825c1bac…799e07e207e4in 1 report
- classaction[.]orgin 1 report
- w[.]mediain 1 report
- doxx[.]netin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.