Scworld

Cybercrime Alliance Formed: Scattered Spider, LAPSUS$, and ShinyHunters Unite

First seen 6 Nov 2025, 17:37 UTC • Infosecurity-Magazine

•80% similarity •40.9

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A new cybercrime alliance called Scattered LAPSUS$ Hunters has been formed, comprising the groups Scattered Spider, LAPSUS$, and ShinyHunters. This coalition aims to provide extortion-as-a-service (EaaS) and conduct coordinated multi-stage attacks on global enterprises, utilizing advanced techniques in social engineering and data theft.

ThreatCluster AI

Attack Flow

8 entities, 15 inferred relationships (STIX 2.1).

Technique (1)

Ransomware

Campaign (1)

Operations Centre

Organization (1)

Salesforce

Malware (1)

BlackLotus

Affected Platform (1)

Threat Actor (3)

DragonForce
Lockbit
Sh1nySp1d3r

Relationships

DragonForce uses BlackLotus
Lockbit uses BlackLotus
Sh1nySp1d3r uses BlackLotus
DragonForce uses Ransomware
Lockbit uses Ransomware
Sh1nySp1d3r uses Ransomware
Operations Centre attributed to DragonForce
Operations Centre attributed to Lockbit
Operations Centre attributed to Sh1nySp1d3r
Operations Centre uses BlackLotus
DragonForce targets Salesforce
Lockbit targets Salesforce
Sh1nySp1d3r targets Salesforce
BlackLotus targets Salesforce
DragonForce related to Telegram

Community

Browse all →

Cybercrime Alliance Formed: Scattered Spider, LAPSUS$, and ShinyHunters Unite

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading