Loading threat actor…
Scattered LAPSUS$ Hunters is a financially motivated cybercriminal collective and loose supergroup branding that overlaps with members or tradecraft associated with Scattered Spider, LAPSUS$, and ShinyHunters. Public reporting consistently describes it as an English-speaking, youth-heavy, non-hierarchical amalgamation rather than a stable, centrally directed organization. The group has also been referenced as SLH, SLSH, and Trinity of Chaos. The actor is associated primarily with data theft and extortion rather than classic encryption-led ransomware, although it has advertised extortion-as-a-service models and has been linked in some reporting to development or branding around ransomware such as SHINYSP1D3R. Its operations have included claims against large enterprises, leak-site activity, Telegram-based victim pressure, insider recruitment, and publication or threatened publication of stolen data. Reported victim sectors include aviation, energy, retail, technology, telecommunications, and government-related targets, with activity also touching SaaS-centric enterprise environments and customer-support platforms. A defining characteristic of Scattered LAPSUS$ Hunters activity is aggressive social engineering and cloud/SaaS abuse. Reported tradecraft includes voice phishing and help-desk impersonation, credential theft, adversary-in-the-middle phishing for MFA tokens, abuse of valid accounts, session hijacking, password-reset manipulation, registration of attacker-controlled MFA devices for persistence, and exploitation of trust relationships between identity providers and downstream SaaS applications. The group has also been associated with compromise of outsourced support personnel and help-desk environments, especially platforms that expose large volumes of customer records and internal administrative workflows. In these intrusions, the actor has been linked to bulk collection of ticket data and attachments, exfiltration from information repositories, and extortion based on stolen personal and enterprise data. Scattered LAPSUS$ Hunters has been publicly tied to the 2025 Salesforce-focused data theft and extortion wave, where attackers allegedly abused access to customer environments and threatened hundreds of organizations. Reporting also links the collective to claims or suspected involvement in incidents affecting Discord, Crunchyroll, Jaguar Land Rover, Resecurity, and other enterprises, though some public claims by the group appear exaggerated, false, or opportunistic. In one notable case, a claimed compromise of a security company reportedly struck a decoy environment rather than production systems. The actor has also been reported to have exposed personal contact information of government officials. The collective’s branding overlaps heavily with ShinyHunters-related extortion activity and with broader “The Com” style social-engineering ecosystems. Some reporting treats Scattered LAPSUS$ Hunters as a syndicate umbrella under which different extortion brands, leak-site personas, and temporary partnerships operate. Attribution remains inherently difficult because the label appears to cover overlapping participants, shared infrastructure, and opportunistic co-branding rather than a single coherent crew.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
43 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as an example of a cybercriminal supergroup/overlapping association in a broader policy discussion about private offensive cyber operations.
Referenced as a tradecraft comparison for shared phishing-kit infrastructure in a related vishing incident.
Mentioned as a collective overlapping with ShinyHunters and associated with attacks using vishing and SaaS-platform exploitation techniques.
Financially motivated extortion activity centered on compromising outsourced BPO agent accounts to access Zendesk, mass-export support tickets and attachments, and pressure victims with threats to publish sensitive user data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.