Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Scattered Spider, Lapsus$, and Shiny Hunters announce shutdown of cybercrime operations

Threat Actor Meta
First reported
Last updated
Happening score
H score 28
1 unique sources, 1 articles

Summary

Hide ▲

Scattered Spider, Lapsus$, and Shiny Hunters announced they were shutting down their cybercrime operations, raising the possibility of a lay-low or rebrand signal rather than a clean exit. The claim matters because it could reshape how the broader cybercrime ecosystem interprets the group’s visibility, recruitment, and future activity. Researchers remained skeptical, noting that such shutdown statements often accompany continued operations under reduced publicity or new identities.

Related Happenings

ShinyHunters Salesforce extortion campaign against global companies in 2025

Campaign
First: 15.01.2026 17:45 Last: 15.01.2026 17:45 Sources 1

About this happening: The **ShinyHunters** campaign now includes a **Qantas** breach disclosed after the airline found a **June 30, 2025** intrusion in a **third-party platform** used by one customer s...

Open Happening

RondoDox persistent IoT and web app botnet campaign

Campaign
First: 01.01.2026 11:19 Last: 01.01.2026 11:19 Sources 1

About this happening: **Scattered Lapsus$ Hunters** claimed they breached **Resecurity** and stole internal chats, logs, employee data, threat intelligence reports, and a complete client list, but Rese...

Latest development: 03.01.2026 22:34

Scattered Lapsus$ Hunters claimed they gained full access to Resecurity systems and stole internal chats, logs, employee data, threat intelligence reports, and a complete client list, while Resecurity said the accessed environment was a deliberately deployed honeypot with fake employee, customer, and payment data used to monitor the actor.

Open Happening

Scattered Spider member surrender and UK arrests

Law Enforcement
First: 24.09.2025 23:21 Last: 24.09.2025 23:21 Sources 1

How related: A member of notorious cybercrime group Scattered Spider has turned himself over to the authorities at Clark County Juvenile Detention Center in Las Vegas, marking the latest "win" for law enforcement against the band of youthful hackers.

About this happening: Authorities **arrested and charged** suspected **Scattered Spider** members in the **UK** and the **US**, including a **17-year-old** who surrendered in **Las Vegas** and was late...

Open Happening

Scattered Lapsus$ Hunters announce shutdown and go dark after forming a multi-group cybercrime umbrella

Threat Actor Meta
First: 17.09.2025 22:12 Last: 17.09.2025 22:12 Sources 1

About this happening: **Scattered Lapsus$ Hunters** and associated aliases announced they are **shutting down** and **going dark**, a notable ecosystem shift that could affect how multiple cybercrime g...

Open Happening

Scattered Spider financial services targeting campaign

Campaign
First: 17.09.2025 11:49 Last: 17.09.2025 11:49 Sources 1

About this happening: The **Scattered Spider** campaign is targeting the **financial sector**, including a live intrusion against an **unnamed U.S. banking organization**. Researchers reported **lookal...

Open Happening

Timeline

  1. 24.09.2025 23:21 2 articles · 8mo ago

    Scattered Spider shutdown claim appears

    Initial Disclosure

    Scattered Spider, alongside Lapsus$ and Shiny Hunters, announced that it was shutting down cybercrime operations, with the message posted as a farewell letter on BreachForums and on the "Scattered Lapsus$ Hunters" public Telegram channel. Some members said they planned to retire while others intended to stay in cybersecurity in more "positive" roles, but the claim drew skepticism because researchers pointed to evidence of continued activity.

    Show sources
    Open in new tab