A Cybercrime Merger Like No Other: The Rise of Scattered Spider, LAPSUS$, and ShinyHunters
The cybercrime underworld is abuzz with the news of a unique merger. Three prominent groups, Scattered Spider, LAPSUS$, and ShinyHunters, have joined forces to form a powerful collective. Since their debut on August 8, 2025, they have created and recreated 16 Telegram channels under various iterations of their original name, showcasing their determination to maintain a public presence despite platform moderation.
This nascent collective has launched data extortion attacks against organizations, including those using Salesforce. They offer an extortion-as-a-service (EaaS) that allows affiliates to demand payments from targets in exchange for using the group's brand and notoriety. All three groups are believed to be affiliated with a loose-knit cybercriminal enterprise known as The Com, characterized by fluid collaboration and brand-sharing.
Telegram remains the central hub for their operations, mirroring the style of hacktivist groups. It serves as a megaphone for disseminating their messaging and marketing their services. The group's administrative posts feature signatures referencing the 'SLH/SLSH Operations Centre', projecting an image of an organized command structure. This strategic branding lends bureaucratic legitimacy to their fragmented communications.
The group's members have also accused Chinese state actors of exploiting vulnerabilities and targeted U.S. and U.K. law enforcement agencies. They have invited channel subscribers to participate in pressure campaigns by finding and emailing C-suite executives, demanding a minimum payment of $100.
Several semi-autonomous groups within The Com network are part of this cohesive alliance, each bringing unique technical capabilities. Shinycorp (aka sp1d3rhunters) acts as a coordinator and manages brand perception, while UNC5537, UNC3944, and UNC6040 are linked to specific extortion campaigns and vishing activities.
Additionally, the group includes identities like Rey and SLSHsupport, responsible for engagement, and yuka (aka Yukari or Cvsp), a self-proclaimed initial access broker with a history of developing exploits.
Scattered LAPSUS$ Hunters' primary focus remains data theft and extortion, but they have hinted at developing a custom ransomware family named Sh1nySp1d3r to rival LockBit and DragonForce. This suggests potential ransomware operations in the future.
Trustwave characterizes the threat actors as a blend of financially motivated cybercrime and attention-driven hacktivism, fueled by monetary incentives and social validation. They have mastered the art of weaponizing perception and legitimacy within the cybercriminal ecosystem.
However, the cybercrime landscape is not without its cartelization. The disclosure of DragonForce, a ransomware group, using a new malware variant to disable security software and terminate protected processes has raised concerns. DragonForce has partnered with Qilin and LockBit to facilitate resource sharing and bolster their capabilities.
Scattered Spider, aligned with DragonForce, functions as an affiliate, breaking into targets through social engineering techniques and deploying remote access tools. This merger of skills and resources highlights the evolving nature of cybercrime, where collaboration and specialization are key.
