In August 2025, the cybersecurity landscape witnessed an unprecedented event — the merger of three notorious cybercriminal organizations: Scattered Spider, LAPSUS$, and ShinyHunters. 

This new collective, known as Scattered LAPSUS$ Hunters (SLH), has emerged as a powerful player in the world of data extortion and cyber-enabled crime. 

The birth of Scattered LAPSUS$ Hunters 

Since its inception, SLH has launched a coordinated network of 16 Telegram channels, continually reappearing under new names despite repeated takedowns. The group promotes its operations, recruits affiliates, and markets its attacks through these channels, adopting the public-facing style of hacktivist groups. 

At the heart of SLH’s operations lies an “extortion-as-a-service” model, where smaller affiliates pay for access to SLH’s brand and infrastructure, much like a ransomware franchise. 

This cartel-style unification of multiple semi-autonomous actors is redefining how cybercrime syndicates operate. The three groups, each one of them infamous for unique tactics and targets, have combined to form a federation under the umbrella of The Com, a loosely organized yet highly collaborative underground network. 

Let’s take a moment to break down each of these groups to understand their operations so far.  

Scattered spider: The social engineering specialists 

Scattered Spider, also known as 0ktapus, UNC3944, or Muddled Libra, rose to infamy through sophisticated social engineering attacks against major corporations like MGM Resorts. 

Their techniques revolve around: 

• Vishing (voice phishing) 

• SMS phishing

• SIM swapping  

• Multi-factor authentication fatigue attacks to infiltrate corporate networks

Once inside, they exploit remote access tools such as AnyDesk, TeamViewer, and ScreenConnect, performing lateral movement and data theft before deploying ransomware, most recently BlackCat/ALPHV, to encrypt enterprise systems. 

Their landmark operation, the 2023 MGM cyberattack, crippled one of the largest hospitality chains in the world by leveraging a simple vishing call to the IT helpdesk, convincing staff to reset an employee’s MFA credentials.  

Their hallmark traits: 

• Young, English-speaking members primarily in the U.S. and Europe 

• They target Fortune 500 firms, BPOs, telecoms, gaming, and hospitality industries. 

• Key strengths include realistic impersonation and rapid exploitation of identity systems like Okta and Azure AD. 

• Their malware arsenal is extensive and includes WarZone RAT, Raccoon Stealer, Vidar Stealer, and BYOVD driver-based tools.  

Dive deeper into Scattered Spider and their social engineering playbook with this campaign. 

ShinyHunters: Masters of vishing and data exfiltration 

The ShinyHunters group, also tracked as UNC6040/UNC6240, gained notoriety in 2025 after Google’s Threat Intelligence Group (GTIG) exposed a Salesforce vishing campaign that compromised more than 20 organizations across North America and Europe. 

Their operation begins with a phone call impersonating IT support, directing employees to authorize a malicious Salesforce-connected app, often disguised as “Data Loader.” Once approved, the attackers exfiltrate massive volumes of CRM data through API queries, then later return under the ShinyHunters alias to demand Bitcoin ransom payments. 

ShinyHunters distinctive tradecraft 

• Initial access: Voice phishing with legitimate-sounding IT pretexts. 

• Data theft: OAuth-connected app abuse for API-based bulk exports. 

• Infrastructure: TOR, Mullvad VPN, and custom Python automation tools for stealth. 

• Evolution: Transition from modified Data Loader binaries to purpose-built collectors 

ShinyHunters’ integration into SLH bridges the data-theft expertise of LAPSUS$ with social-engineering finesse from Scattered Spider, creating an ecosystem capable of stealing, monetizing, and publicizing breaches at scale. 

Explore the ShinyHunters Salesforce vishing campaign in depth here. 

LAPSUS$: The data extortion disruptors 

LAPSUS$ first captured global headlines for brazenly leaking source code from companies like NVIDIA, Samsung, LG, Microsoft, and Okta. 

Unlike typical ransomware operators, LAPSUS$ thrives on data extortion without encryption, stealing sensitive information and then threatening to leak it for profit or notoriety. 

Their hallmark is psychological manipulation. They purchase stolen credentials, recruit insiders, and impersonate IT support to reset privileged accounts. 

They exploit unpatched collaboration tools like JIRA, GitLab, and Confluence, using Mimikatz and DCSync for privilege escalation. 

To bypass MFA, they rely on SIM swapping and MFA fatigue attacks, a hallmark technique now observed in the wider SLH ecosystem. 

LAPSUS$ play a key role in the SLH group 

Up until the news of this merger, LAPSUS$ was presumed inactive. In this cybercrime union, they contribute the psychological warfare and publicity machine. Their Telegram-style leaks and social theatrics amplify SLH’s brand power, while their extortion tactics align seamlessly with the collective’s monetization model. 

To understand LAPSUS$ techniques and past activity in depth, book the LAPSUS$ Destruction Live-Fire Exercise and gain hands-on experience investigating a LAPSUS$-inspired attack targeting an AWS environment.  

Not a Cyberbit customer? Book a demo today! 

A convergence of chaos and the implications of the Scattered LAPSUS$ Hunters merger 

The formation of Scattered LAPSUS$ Hunters represents a paradigm shift in cybercrime collaboration and marks a new era of digital threat sophistication. 

It demonstrates how financially motivated groups are adopting cartel-like alliances, combining resources and personas across overlapping ecosystems such as The Com, CryptoChameleon, and Crimson Collective.  

• Scattered Spider provides advanced social engineering and access brokerage. 

• ShinyHunters contributes data theft automation and vishing scalability. 

• LAPSUS$ brings media manipulation and extortion expertise. 

The result is a federated threat architecture that blurs the line between traditional cybercrime and hacktivism. Their tactics merge financial motives with performative branding, weaponizing reputation and perception to drive recruitment, fear, and notoriety. 

As cybersecurity vendors race to adapt, SLH’s coordinated structure suggests a future where cybercriminal “mergers and acquisitions” become as strategic as those in the corporate world, but far more dangerous. 

As law enforcement agencies and cybersecurity defenders react, one thing is clear. Cybercrime has entered its age of collaboration, and it’s more organized, resilient, and publicly performative than ever before.