Scattered LAPSUS$ Hunters federated extortion collective
Threat Actor Meta
Summary
Hide ▲
Show ▼
Scattered LAPSUS$ Hunters (SLH) has been identified as a coordinated alliance linking Scattered Spider, ShinyHunters and LAPSUS$, creating a unified brand that expands its extortion reach and underground influence. The group is using Telegram as a command-and-brand hub, rebuilding channels rapidly and presenting a more durable operating model than a loose collaboration. The consolidation raises the risk of faster extortion-as-a-service scaling and broader recruitment across the criminal ecosystem.
Related Happenings
TeamPCP supply-chain ecosystem shift and extortion partnerships
Threat Actor Meta
First: 22.05.2026 14:55
Last: 22.05.2026 14:55
Sources 1
About this happening:
**TeamPCP** has expanded its supply-chain abuse model across open-source ecosystems, raising the risk of downstream compromise and extortion at scale. The group has **corrupted hu...
TeamPCP supply-chain ecosystem shift and extortion partnerships
Threat Actor MetaAbout this happening: **TeamPCP** has expanded its supply-chain abuse model across open-source ecosystems, raising the risk of downstream compromise and extortion at scale. The group has **corrupted hu...
Vect RaaS affiliate recruitment and early ecosystem buildout
Threat Actor Meta
First: 03.02.2026 16:00
Last: 03.02.2026 16:00
Sources 1
About this happening:
**Vect** has moved into **affiliate recruitment**, marking an early-stage **ransomware-as-a-service** buildout that could expand its reach and victim volume. The group has already...
Vect RaaS affiliate recruitment and early ecosystem buildout
Threat Actor MetaAbout this happening: **Vect** has moved into **affiliate recruitment**, marking an early-stage **ransomware-as-a-service** buildout that could expand its reach and victim volume. The group has already...
Scattered Lapsus Shiny Hunters' harassment-driven extortion operating model
Threat Actor Meta
First: 02.02.2026 18:15
Last: 02.02.2026 18:15
Sources 1
About this happening:
**Scattered Lapsus Shiny Hunters (SLSH)** is now using a **harassment-driven extortion model** that pairs stolen data with swatting, threats, and publicity pressure, raising the s...
Scattered Lapsus Shiny Hunters' harassment-driven extortion operating model
Threat Actor MetaAbout this happening: **Scattered Lapsus Shiny Hunters (SLSH)** is now using a **harassment-driven extortion model** that pairs stolen data with swatting, threats, and publicity pressure, raising the s...
DragonForce rebrands as a ransomware cartel and expands its affiliate model
Threat Actor Meta
First: 03.12.2025 17:05
Last: 03.12.2025 17:05
Sources 1
About this happening:
**DragonForce** rebranded itself as a **ransomware cartel** in **2025**, widening its affiliate model and lowering entry barriers for new operators. The shift matters because the...
DragonForce rebrands as a ransomware cartel and expands its affiliate model
Threat Actor MetaAbout this happening: **DragonForce** rebranded itself as a **ransomware cartel** in **2025**, widening its affiliate model and lowering entry barriers for new operators. The shift matters because the...
DragonForce campaign expands across multiple victims
Campaign
First: 03.12.2025 17:05
Last: 03.12.2025 17:05
Sources 1
About this happening:
**DragonForce** and **Scattered Spider** are driving a **multistage ransomware campaign** that pairs social engineering with follow-on encryption to hit **high-value targets world...
DragonForce campaign expands across multiple victims
CampaignAbout this happening: **DragonForce** and **Scattered Spider** are driving a **multistage ransomware campaign** that pairs social engineering with follow-on encryption to hit **high-value targets world...
Timeline
-
04.11.2025 16:15 2 articles · 6mo ago
Trustwave identifies Scattered LAPSUS$ Hunters as a federated alliance
Initial DisclosureTrustwave SpiderLabs identifies Scattered LAPSUS$ Hunters (SLH) as a coordinated alliance blending Scattered Spider, ShinyHunters and LAPSUS$ under a shared operational banner. The group is using Telegram as a command-and-brand hub, has cycled through at least 16 public channels since early August, and Trustwave assesses fewer than five core operators behind roughly 30 personas, with ShinyHunters-linked identities appearing to lead the structure.
Show sources
- Scattered Spider, ShinyHunters and LAPSUS$ Form Unified Collective — www.infosecurity-magazine.com — 04.11.2025 16:15
- Scattered Spider, ShinyHunters and LAPSUS$ Form Unified Collective — www.infosecurity-magazine.com — 04.11.2025 16:15