Loading threat actor…
Scattered LAPSUS$ Shiny Hunters (SLSH), also referred to as Scattered Lapsus$ ShinyHunters, is a Western cybercrime threat actor associated with the broader online criminal milieu known as The Com. Reporting describes the group as maintaining a loosely decentralized structure with operational overlap involving Scattered Spider (UNC3944), LAPSUS$, and ShinyHunters. It is notable as an outlier to the more typical post-Soviet ransomware ecosystem. The actor is linked to high-impact extortion and intrusion activity centered on cloud and SaaS environments rather than traditional encryption-led ransomware. Its operations have been associated with pay-or-leak extortion, including public ransom demands and threats to publish stolen data, and with disruptive follow-on actions such as defacement of victim-facing login portals. Reported activity includes attacks affecting educational technology platforms and supply-chain compromise of SaaS integrations tied to Salesforce environments. SLSH has been tied to compromise of third-party application ecosystems in which stolen or abused OAuth tokens enabled API-level access across large numbers of downstream customer tenants, in some cases without multi-factor authentication barriers. Reported post-compromise objectives included access to sensitive business records and customer data, large-scale data extraction, and the ability in some environments to manipulate or mask data. In certain configurations, the actor’s access could extend to highly privileged roles, increasing the risk of broad tenant compromise. The group’s observed tradecraft includes initial access through trusted third-party relationships, abuse of cloud application tokens, unauthorized API activity, exfiltration, post-exploitation in SaaS environments, and extortion based on stolen data rather than file encryption. Publicly claimed operations have affected universities and major enterprise technology users, and reporting notes disruption across numerous sectors with harmful economic impact in the United Kingdom. The actor’s profile is primarily financially motivated.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a named threat actor or activity cluster with operational overlap with ShinyHunters.
SLSH is conducting sophisticated supply chain attacks targeting Salesforce and its ecosystem, compromising third-party applications (such as Gainsight and Salesloft) to obtain OAuth tokens and gain API-level access to client Salesforce environments. Their operations include data exfiltration, manipulation, and potential extortion, leveraging automation and anonymization techniques.
Western cybercrime actors (linked in the text as an exception to post-Soviet ransomware landscape) associated with disruptive activity across multiple sectors; described as emerging from 'The Com'.
Western, youth-linked cybercrime cluster associated with disruptive activity across numerous sectors; described as an anomaly compared to post-Soviet ransomware ecosystem.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.