Lapsus$ Hunters — Threat Actor Profile, Campaigns & Targets

Threat entity extracted from intelligence sources

Frequency
3
occurrences
First Seen
November 14, 2025
Last Seen
January 6, 2026

Lapsus$ Hunters is an apt_group tracked by ThreatCluster, appearing in 4 threat clusters built from 3 intelligence report mentions.

Lapsus$ Hunters is a apt_group tracked across 4 threat clusters and 3 intelligence report mentions on ThreatCluster. First observed November 14, 2025; most recent activity January 6, 2026.

Related Threat Clusters

  • Jaguar Land Rover Cyberattack Costs £485m in Q2 2025

    Jaguar Land Rover (JLR) reported a £485 million loss for Q2 2025 following a cyberattack that shut down production for over a month. The attack, which occurred in August, resulted in exceptional costs of £196 million…

    12 articles · Updated November 17, 2025
  • JLR Cyber Attack Causes Significant Drop in UK Car Production

    Jaguar Land Rover (JLR), the UK's largest automotive employer, experienced a cyber attack on August 31, 2025, which halted production. As a result, UK car production fell by 24% in October compared to the previous year,…

    21 articles · Updated November 28, 2025
  • Researchers Trap Scattered Lapsus$ Hunters in Honeypot

    Researchers have successfully lured members of the Lapsus$ hacking group into a honeypot using fake accounts and synthetic data. This operation allowed them to gather valuable information on the hackers' servers. The…

    3 articles · Updated January 6, 2026
  • Scattered Lapsus$ Hunters Target Zendesk with Typosquatted Domains

    The Scattered Lapsus$ Hunters have launched a cyber offensive exploiting supply-chain vulnerabilities by registering over 40 typosquatted domains that mimic Zendesk environments. This campaign aims to turn Zendesk, a…

    2 articles · Updated November 28, 2025

Recent Intelligence Reports

  • Researchers Trap Scattered Lapsus$ Hunters in Honeypot — Feeds.Feedburner · January 6, 2026
  • Lapsus$ Hunters Register 40+ Domains Impersonating Zendesk Environments — Gbhackers · November 27, 2025
  • Jaguar Land Rover cyber attack costs firm £485m in the quarter — Computerweekly · November 14, 2025

Frequently asked questions

What is Lapsus$ Hunters?

Lapsus$ Hunters is an apt_group tracked by ThreatCluster, appearing in 4 threat clusters built from 3 intelligence report mentions.

Is Lapsus$ Hunters still active?

The most recent intelligence report mentioning Lapsus$ Hunters on ThreatCluster is dated January 6, 2026. Activity was first observed November 14, 2025, giving a tracked span from then to January 6, 2026.

What is Lapsus$ Hunters associated with?

Across ThreatCluster reporting, Lapsus$ Hunters most frequently co-occurs with Scattered Spider, ShinyHunters, ShinyHunters Collective, Phishing, Co-op Group, among 9 tracked related entities.

What are the latest developments involving Lapsus$ Hunters?

The most significant recent cluster is “Jaguar Land Rover Cyberattack Costs £485m in Q2 2025” (12 articles · Updated November 17, 2025). Lapsus$ Hunters appears across 4 threat clusters in total, listed above with sources.

How much reporting does ThreatCluster have on Lapsus$ Hunters?

Lapsus$ Hunters appears in 3 intelligence report mentions across 4 deduplicated threat clusters, aggregated from 17,000+ monitored sources.

CVSS v3.1 Breakdown