Video Examines Unverified “Shiny Spider” Ransomware-as-a-Service Claim

Summary

The hosts discuss a briefly active Telegram channel claiming Shiny Hunters, Scattered Spider and Lapsis$ were developing a ransomware-as-a-service operation called Shiny Spider. Telegram removed the channel after three days; the alliance remains unverified.

Key points

A Telegram channel named Scattered Lapsis Hunters claimed the three groups were developing a ransomware-as-a-service offering called Shiny Spider.
The speakers say Telegram removed the channel three days after it appeared; they do not verify that the groups were actually collaborating.
The video describes Shiny Hunters as linked to breaches, data-trading forums and activity targeting Salesforce.
Scattered Spider is described as linked to the cybercrime network the Comm and as using social engineering and ransomware.
Lapsis$ is described as a social-engineering and extortion group that steals data rather than typically encrypting systems.
The hosts discuss social engineering, ransomware, spear phishing and SIM swapping, and name retail, insurance and aviation among targeted sectors.

Article Details

Topics: [00:26] A Telegram channel claims Shiny Hunters, Scattered Spider and Lapsis$ are joining forces on a ransomware-as-a-service offering.
[02:28] Background on Shiny Hunters and its reported breaches, forums and Salesforce-targeting activity.
[03:44] Scattered Spider’s reported links to the Comm, social engineering and ransomware.
[04:21] Lapsis$ and the distinction between data extortion and ransomware encryption.
[05:52] The alleged Shiny Spider service and Telegram’s removal of the channel.
[07:03] Potential combined tactics and the sectors the groups reportedly target.