Scattered Lapsus$ Hunters announce shutdown and go dark after forming a multi-group cybercrime umbrella
Threat Actor Meta
Summary
Hide ▲
Show ▼
Scattered Lapsus$ Hunters and associated aliases announced they are shutting down and going dark, a notable ecosystem shift that could affect how multiple cybercrime groups coordinate and brand their operations. The move matters because the umbrella now spans Scattered Spider, LAPSUS$, ShinyHunters, and other named actors, while researchers still see signs of continued targeting. The announcement may be a genuine wind-down, a rebrand, or an effort to create a false sense of security for victims and defenders.
Related Happenings
FBI Seattle victim-outreach notice on Steam malware investigation
Public Sector Action
First: 16.03.2026 13:15
Last: 16.03.2026 13:15
Sources 1
About this happening:
The **FBI Seattle Division** issued a **mid-March 2026** victim-outreach notice asking gamers who downloaded malware from **Steam** to help identify affected victims in an active...
FBI Seattle victim-outreach notice on Steam malware investigation
Public Sector ActionAbout this happening: The **FBI Seattle Division** issued a **mid-March 2026** victim-outreach notice asking gamers who downloaded malware from **Steam** to help identify affected victims in an active...
Dort Kimwolf retaliatory harassment campaign
Campaign
First: 28.02.2026 14:01
Last: 28.02.2026 14:01
Sources 1
About this happening:
The **Dort**-controlled **Kimwolf** operation escalated into a **targeted harassment campaign** against the researcher and the author, combining **DDoS**, **doxing**, and **email...
Dort Kimwolf retaliatory harassment campaign
CampaignAbout this happening: The **Dort**-controlled **Kimwolf** operation escalated into a **targeted harassment campaign** against the researcher and the author, combining **DDoS**, **doxing**, and **email...
FBI Operation Winter SHIELD cyber resilience campaign
Public Sector Action
First: 29.01.2026 18:50
Last: 29.01.2026 18:50
Sources 1
About this happening:
The **FBI** launched **Operation Winter SHIELD**, issuing **ten recommended actions** to help organizations harden **IT and OT environments** against **cyber-attacks and malicious...
FBI Operation Winter SHIELD cyber resilience campaign
Public Sector ActionAbout this happening: The **FBI** launched **Operation Winter SHIELD**, issuing **ten recommended actions** to help organizations harden **IT and OT environments** against **cyber-attacks and malicious...
UAT-7290 long-running telecom espionage campaign
Campaign
First: 08.01.2026 18:00
Last: 08.01.2026 18:00
Sources 1
About this happening:
**UAT-7290** is running a **long-running cyber-espionage campaign** against **telecommunications providers** in South Asia, with recent expansion into Southeastern Europe. The ope...
UAT-7290 long-running telecom espionage campaign
CampaignAbout this happening: **UAT-7290** is running a **long-running cyber-espionage campaign** against **telecommunications providers** in South Asia, with recent expansion into Southeastern Europe. The ope...
Scattered Spider-ShinyHunters-Lapsus$ collective advertises RaaS launch
Threat Actor Meta
First: 21.11.2025 12:15
Last: 21.11.2025 12:15
Sources 1
About this happening:
The **Scattered Spider-ShinyHunters-Lapsus$ collective** is advertising an upcoming **ransomware-as-a-service (RaaS)** offering, signaling a possible shift toward a more scalable...
Scattered Spider-ShinyHunters-Lapsus$ collective advertises RaaS launch
Threat Actor MetaAbout this happening: The **Scattered Spider-ShinyHunters-Lapsus$ collective** is advertising an upcoming **ransomware-as-a-service (RaaS)** offering, signaling a possible shift toward a more scalable...
Timeline
-
17.09.2025 22:12 2 articles · 8mo ago
Scattered Lapsus$ Hunters announces it is going dark
Initial DisclosureScattered Lapsus$ Hunters says it has fulfilled its objectives and is going dark after a farewell letter on BreachForums and a public Telegram channel named Scattered Spider, LAPSUS$, ShinyHunters, and related aliases among the group set. Reliaquest later reported signs of Scattered Spider targeting the financial sector, including a targeted intrusion against a US banking organization, suggesting activity continued after the shutdown claim.
Show sources
- 'Scattered Lapsus$ Hunters,' Others Announce End of Hacking Spree — www.darkreading.com — 17.09.2025 22:12
- 'Scattered Lapsus$ Hunters,' Others Announce End of Hacking Spree — www.darkreading.com — 17.09.2025 22:12