Scattered Lapsus$ Hunters
Scattered LAPSUS$ Hunters (also referred to as SLH, SLSH, LPH, and Trinity of Chaos) is described in the provided reporting as a financially motivated cybercriminal conglomerate formed in mid-2025 from Scattered Spider, LAPSUS$, and ShinyHunters. The group is characterized as a loose amalgamation of typically young, reckless, English-speaking hackers and is associated with data theft, extortion, leak-site operations, and social-engineering-driven intrusions rather than traditional file-encrypting ransomware alone. Across the cited reporting, Scattered LAPSUS$ Hunters is linked to large-scale exfiltration and extortion activity, including the Salesforce-related data theft campaign affecting hundreds of companies, claims against Salesforce itself, and attacks or claimed attacks involving Resecurity, SK Telecom, Jaguar Land Rover, Discord/Zendesk-related exposure, Marks & Spencer, Co-op, Harrods, and Instructure’s September 2025 Salesforce incident. The group also reportedly exposed phone numbers and addresses of hundreds of government officials, including nearly 700 from DHS. The group’s tradecraft in the provided content centers on interactive social engineering, especially vishing and help-desk impersonation, credential theft, abuse of compromised authentication tokens, insider recruitment, and post-compromise extortion. Reporting states that the actors increasingly used human-driven interactive social engineering in 2025, sought insider access in sectors including call centers, gaming, hosting, SaaS, and telecom, and operated extortion schemes without necessarily deploying file encryption. The group used Telegram channels and dark web leak sites to communicate, threaten victims, advertise extortion-as-a-service, and publish or threaten stolen data. The content also notes overlap and affiliated branding with ShinyHunters and other offshoots or related subsets, including CoinbaseCartel as a data-theft offshoot of the broader collective. Public reporting cited in the content also references possible ransomware branding such as SHINYSP1D3R, though the reporting explicitly states it was unclear whether that capability was genuinely under development.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
Tradecraft
47 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransom-motivated group that falsely claimed complete compromise and data theft from Resecurity, but was instead caught in a decoy environment that aided law-enforcement follow-on action.
Data-leak and extortion crew that falsely claimed full access to Resecurity systems but instead fell into a honeypot, leading to investigative action.
Larger cybercriminal collective from which CoinbaseCartel emerged as a data-theft offshoot.
Named as an interconnected extortionist network associated with The Com, involved in SIM swapping and coercive/extortion activity including threats of physical harm.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.