Scattered Lapsus$ Hunters signal extortion-as-a-service shift and possible new ransomware testing
Threat Actor Meta
Summary
Hide ▲
Show ▼
Scattered Lapsus$ Hunters are signaling a move toward extortion-as-a-service (EaaS), a shift that could widen their reach while reducing direct attribution pressure. Observations from early October 2025 also point to testing of a possible ransomware build, SHINYSP1D3R, adding uncertainty about whether the group is expanding beyond pure extortion. The change matters because it could help the actors fly under the radar of law enforcement and reshape the wider The Com criminal ecosystem.
Related Happenings
Charter Communications hit by network compromise linked to ShinyHunters
Incident
First: 26.05.2026 22:46
Last: 26.05.2026 22:46
Sources 1
About this happening:
**Charter Communications** confirmed a **data breach** tied to **ShinyHunters** extortion, raising the risk of customer-data exposure and active follow-on pressure. The company sa...
Charter Communications hit by network compromise linked to ShinyHunters
IncidentAbout this happening: **Charter Communications** confirmed a **data breach** tied to **ShinyHunters** extortion, raising the risk of customer-data exposure and active follow-on pressure. The company sa...
Ransomware ecosystem fragments into smaller agile cells in 2025
Threat Actor Meta
First: 18.02.2026 13:30
Last: 18.02.2026 13:30
Sources 1
About this happening:
**Ransomware** activity in **2025** is becoming more fragmented and harder to track, with **124 groups** and **73 new groups** signaling a more crowded threat market. The shift ma...
Ransomware ecosystem fragments into smaller agile cells in 2025
Threat Actor MetaAbout this happening: **Ransomware** activity in **2025** is becoming more fragmented and harder to track, with **124 groups** and **73 new groups** signaling a more crowded threat market. The shift ma...
ShinyHunters data-leak site exposing stolen attack data
Data Leak
First: 31.01.2026 17:02
Last: 31.01.2026 17:02
Sources 1
About this happening:
The **ShinyHunters** extortion gang launched a **data-leak site**, beginning to publish data tied to the theft campaign and raising the exposure risk for victims.
ShinyHunters data-leak site exposing stolen attack data
Data LeakAbout this happening: The **ShinyHunters** extortion gang launched a **data-leak site**, beginning to publish data tied to the theft campaign and raising the exposure risk for victims.
Rising encryptionless extortion incidents against enterprises in 2025
Target Trend
First: 15.01.2026 17:45
Last: 15.01.2026 17:45
Sources 1
About this happening:
**Encryptionless extortion** surged in **2025** as attackers increasingly skipped ransomware encryption and instead stole data to pressure victims across **enterprise environments...
Rising encryptionless extortion incidents against enterprises in 2025
Target TrendAbout this happening: **Encryptionless extortion** surged in **2025** as attackers increasingly skipped ransomware encryption and instead stole data to pressure victims across **enterprise environments...
DragonForce rebrands as a ransomware cartel and expands its affiliate model
Threat Actor Meta
First: 03.12.2025 17:05
Last: 03.12.2025 17:05
Sources 1
About this happening:
**DragonForce** rebranded itself as a **ransomware cartel** in **2025**, widening its affiliate model and lowering entry barriers for new operators. The shift matters because the...
DragonForce rebrands as a ransomware cartel and expands its affiliate model
Threat Actor MetaAbout this happening: **DragonForce** rebranded itself as a **ransomware cartel** in **2025**, widening its affiliate model and lowering entry barriers for new operators. The shift matters because the...
Timeline
-
22.10.2025 11:30 2 articles · 7mo ago
Scattered Lapsus$ Hunters discuss EaaS and test SHINYSP1D3R
Technical Analysis UpdateTelegram posts made on October 4, 2025 show Scattered Lapsus$ Hunters discussing an extortion-as-a-service (EaaS) program and testing a new ransomware variant believed to be dubbed SHINYSP1D3R.
Show sources
- Scattered Lapsus$ Hunters Signal Shift in Tactics — www.infosecurity-magazine.com — 22.10.2025 11:30
- Scattered Lapsus$ Hunters Signal Shift in Tactics — www.infosecurity-magazine.com — 22.10.2025 11:30
-
22.10.2025 11:30 1 articles · 7mo ago
Scattered Lapsus$ Hunters set an October 10 ransom deadline and leak data
Victim Impact UpdateScattered Lapsus$ Hunters set 11:59 PM ET on October 10, 2025 as the ransom payment deadline, and data linked to at least six companies was released.
Show sources
- Scattered Lapsus$ Hunters Signal Shift in Tactics — www.infosecurity-magazine.com — 22.10.2025 11:30
-
22.10.2025 11:30 1 articles · 7mo ago
Scattered Lapsus$ Hunters say nothing else will be leaked
Victim Impact UpdateOn October 11, 2025, after the deadline passed and the six-organization data release had already occurred, Scattered Lapsus$ Hunters said "nothing else will be leaked".
Show sources
- Scattered Lapsus$ Hunters Signal Shift in Tactics — www.infosecurity-magazine.com — 22.10.2025 11:30