Loading story…
A cybercrime alliance known as the Trinity of Chaos, comprising the threat groups LAPSUS$, Scattered Spider, and ShinyHunters, has recently disbanded, but intelligence reports indicate that its members are likely to continue their malicious activities. The alliance, also referred to as Scattered Lapsus$ Hunters, was formed to pool resources and expertise among these high-profile cybercriminal groups. Despite the formal dissolution of the collective, ShinyHunters have already claimed responsibility for new attacks targeting the financial services sector, demonstrating that the threat from these actors remains active. Security researchers from Resecurity and ReliaQuest have observed similar intrusion patterns attributed to Scattered Spider, suggesting ongoing operations by former alliance members. The groups involved in the Trinity of Chaos have previously been linked to significant breaches affecting major organizations such as Google, Qantas, and LVMH, which has bolstered their reputation within the cybercriminal ecosystem. Analysts believe that the disbandment is likely a strategic move, allowing the groups to reorganize and rebrand under new identities while evading law enforcement scrutiny. This tactic mirrors previous behavior seen in the cybercrime landscape, such as the Conti ransomware gang's public exit and subsequent reemergence under different names. The alliance's connection to The Com collective further underscores the collaborative nature of modern cybercrime, where threat actors share tools, tactics, and intelligence. Security experts warn that the credibility and experience gained from past high-profile intrusions will make these groups even more formidable as they resurface. The ongoing threat is compounded by the likelihood that these actors will adopt new monikers and operational structures, making detection and attribution more challenging for defenders. The financial services industry remains a primary target, but the groups' history suggests that other sectors could also be at risk. The use of distributed denial-of-service (DDoS) attacks and sophisticated intrusion techniques has been a hallmark of their operations. Organizations are advised to remain vigilant and update their threat models to account for the evolving tactics of these adversaries. The dissolution of the Trinity of Chaos does not signal a reduction in cyber risk; rather, it marks a transition to a new phase of activity by its constituent groups. Intelligence sharing and proactive defense measures are critical to mitigating the impact of future attacks. The cybercrime landscape continues to evolve, with alliances forming and dissolving as threat actors adapt to law enforcement pressure and shifting opportunities. The legacy of the Trinity of Chaos is likely to influence cybercriminal collaboration and operational strategies for the foreseeable future.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
The Guardian reported that the cybercrime network known as The Com was behind a recent hack affecting Pornhub. This adds a new publicly identified victim to the broader campaign associated with The Com and its linked actors.
ZeroFox published a flash report describing a powerful new ransomware-as-a-service operation linked to actors associated with Scattered Spider, LAPSUS$, and ShinyHunters. The report suggests the alliance's restructuring evolved into a more formalized ransomware capability beyond the previously reported attacks.
Resecurity said the full scale of the campaign is only beginning to surface because the actors often use private extortion to keep incidents out of public view. The report also noted Tata Consultancy Services' connection as an IT provider to several targeted companies.
Following the disruptive attack on Jaguar Land Rover, the UK government responded with substantial financial support to the company. The move underscored the severity of the incident and the broader national concern around the campaign.
The latest wave of attacks was reported to have hit Jaguar Land Rover, Marks & Spencer, and Co-op, causing significant operational and financial impact. Security researchers said many additional victims and breaches tied to the campaign have not yet been publicly disclosed.
Resecurity and ReliaQuest reported new intrusions and assessed that Scattered Spider, LAPSUS$, and ShinyHunters-linked actors were actively reorganizing and launching fresh attacks despite claims of disbandment or retirement. The activity included new attacks claimed by ShinyHunters against the financial services sector.
Before the latest reporting, ShinyHunters had indicated it was stepping back from ransomware activity. Researchers later assessed this apparent exit as likely tactical rather than a genuine end to operations.
Researchers cited prior attacks attributed to actors tied to the alliance, including intrusions affecting Google, Qantas, and LVMH. These incidents were presented as part of the group's broader campaign history before the latest restructuring disclosures.
Resecurity reported that members associated with LAPSUS$, ShinyHunters, and Scattered Spider forged a collaborative cybercrime alliance later dubbed the 'Trinity of Chaos.' Researchers linked the grouping to The Com collective and assessed it as a coordinated criminal partnership rather than isolated actors.
Cyber Daily reported that ShinyHunters had joined with Scattered Spider in a new hacking 'supergroup' and was teasing major forthcoming leaks. The report marked an earlier public indication of collaboration between the actors before later 'Trinity of Chaos' reporting expanded the alliance to include additional members.
ReliaQuest reported that ShinyHunters was likely collaborating with, or significantly overlapping with, Scattered Spider based on converging tactics, infrastructure, and victimology. The researchers cited shared use of IT-support impersonation vishing, Okta-themed phishing pages, Salesforce Data Loader abuse, Mullvad VPN, and similar sector targeting.
CBS News reported that Scattered Spider had teamed up with the BlackCat/ALPHV ransomware gang, marking a notable collaboration between the social-engineering-focused group and an established Russian-speaking ransomware operation. This reflects an earlier stage in Scattered Spider's evolution before the later 'Trinity of Chaos' reporting.
16 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcetheguardian.com
Open sourcehalcyon.ai
Open sourcecyfirma.com
Open sourcetheregister.com
Open sourcefalconfeeds.io
Open sourcecomputerweekly.com
Open sourcecbsnews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new cybercrime supergroup known as Scattered LAPSUS$ Hunters has emerged in 2025, combining the capabilities and tactics of three notorious threat actors: Scattered Spider, LAPSUS$, and ShinyHunters. This alliance marks a significant escalation in the threat landscape, as the group leverages a blend of social engineering, technical attacks, and public extortion to target high-value enterprise environments. The group is known for its multi-phase assaults, which often begin with sophisticated social engineering techniques such as phone-based vishing to gain initial access, particularly by targeting help desks and exploiting human vulnerabilities. Once inside, the attackers employ insider recruitment, source code theft, and large-scale data exfiltration, drawing on the distinct strengths of each constituent group. Scattered LAPSUS$ Hunters have focused their attacks on major SaaS platforms, including Salesforce, as well as enterprise applications from Oracle and SAP. Their victim list includes prominent organizations across retail, aviation, insurance, and automotive sectors, with named targets such as Home Depot, Marriott, the National Bank of Canada, and Tata Motors' Jaguar Land Rover. The group’s operations are characterized by unpredictability and a willingness to disrupt major businesses, often causing significant operational and reputational damage. Unlike traditional ransomware groups, Scattered LAPSUS$ Hunters do not limit themselves to endpoint infections and ransom demands; they also engage in ransoming stolen data and public extortion campaigns. The group’s members, reportedly including Western teenagers with substantial cryptocurrency holdings, operate with little regard for the consequences of their actions, further complicating law enforcement efforts. Their tactics reflect a shift from the previously dominant Russian ransomware model to a more chaotic, opportunistic approach. The group’s emergence from the cybercrime community known as The Com highlights the evolving nature of cybercriminal alliances and the increasing sophistication of their playbooks. Security experts have noted that the group’s attacks are not only technically advanced but also highly adaptive, making them particularly challenging to defend against. Organizations are advised to strengthen their social engineering defenses, monitor for insider threats, and enhance detection capabilities for unusual access patterns. The rise of Scattered LAPSUS$ Hunters underscores the need for a holistic security posture that addresses both technical and human vulnerabilities. Their activities in 2025 have set a new benchmark for the scale and impact of cybercrime supergroups, prompting urgent calls for improved cross-sector collaboration and intelligence sharing.
Jun 29, 2026
Scattered Spider, LAPSUS$, and ShinyHunters have merged to form a new cybercriminal collective known as Scattered LAPSUS$ Hunters (SLH), launching in early August 2025. This alliance operates as a federated entity, leveraging the reputations and operational tactics of its constituent groups to offer Extortion-as-a-Service (EaaS) to affiliates. The group has used Telegram as its primary platform for coordination, public announcements, and brand-building, frequently recreating channels to evade platform moderation. SLH has also established data leak sites on both the clear web and the dark web to publish proof-of-compromise materials and intimidate victims, including organizations using Salesforce. The collective is closely associated with the broader cybercriminal milieu known as "The Com," which is characterized by fluid collaboration and brand-sharing among threat actors. SLH's emergence marks a deliberate attempt to consolidate influence and amplify the impact of extortion campaigns by uniting well-known cybercrime brands. The group has also displayed affiliations with other clusters such as CryptoChameleon and Crimson Collective, further expanding its operational reach and narrative. The adoption of a centralized "Operations Centre" label on Telegram posts projects an image of organizational legitimacy, enhancing the group's ability to market its services and attract affiliates.
Jun 29, 2026
The Scattered Lapsus$ Hunters (SLSH), a cybercrime collective formed from members of Scattered Spider, Lapsus$, and ShinyHunters, announced a temporary retreat from online activity after the FBI seized their clearweb site. The group, known for its Western and English-speaking membership, issued a series of aggressive messages on Telegram, vowing to retaliate against the FBI and promising a return in 2026. This announcement followed a period of heightened law enforcement scrutiny, including the arrest and charging of two teenagers in the UK for their alleged involvement in attacks attributed to Scattered Spider, a component of SLSH. The group has a history of dramatic exits and returns, having previously declared a hiatus only to reappear days later. SLSH has gained notoriety for targeting large organizations and for the scale of its operations. In parallel with their public threats, the group claimed responsibility for a massive data breach affecting 39 major companies worldwide, exploiting a Salesforce vulnerability to steal 989 million records. They demanded negotiations with Salesforce and the affected firms, threatening to release the data if ignored. When their demands were unmet, SLSH published data allegedly belonging to six companies, including Qantas Airways, Vietnam Airlines, Fujifilm, GAP Inc., Engie Resources, and Albertsons Companies. The leaked datasets reportedly contain extensive personally identifiable information (PII), such as full names, addresses, passport numbers, phone numbers, email addresses, and, in the case of Qantas, detailed frequent flyer information and internal business data. The Qantas dataset alone is said to be 153 GB and includes over 5 million records. The authenticity of the data has been partially verified by independent analysis, though only the affected companies can fully confirm the breach. The exposure of such sensitive information poses significant risks for identity theft, fraud, and targeted attacks against both individuals and organizations. The SLSH collective's actions have prompted calls for increased vigilance and improved cybersecurity measures among large enterprises, especially those using cloud-based platforms like Salesforce. Law enforcement agencies continue to investigate and pursue members of the group, while the cybersecurity community monitors for further developments and potential retaliatory actions promised by SLSH upon their return.
Jun 29, 2026