Scattered Lapsus$ Hunters

Reported Context (23)

Explicit alternate name for SP1D3R HUNTERS, also named SLH and SLSH. Intel 471's 2026 Outlook Reports 63% Rise in Extortion Breach Events
Claimed high-profile extortion campaigns; also named SLSH, Shinysp1d3r, and Sp1d3rHunters. Its claimed merger with other groups is unverified. Recorded Future’s 2026 Security Report Highlights Persistent Access and Fragmenting Cybercrime
The report identifies the group as a prominent example of criminals weaponizing identity attacks in 2025. Sophos 2026 Active Adversary Report: Identity Failures Dominate Initial Access
Also called SLH in the report; described as an alliance of three sub-groups of The Com using AI-enhanced social engineering and help-desk manipulation. Dataminr’s 2026 Threat Report Highlights Identity Attacks and Larger Cyber Losses
Identified in the report as TAT25-84; abused help-desk workflows, password resets, and MFA enrollment to compromise enterprise systems, causing downstream industrial disruption without observed ICS access. Dragos 2026 OT Security Report Details Threat Groups Mapping Industrial Control Loops

CVE (47)

Malware (85)

People (41)

Threat Actors (158)

MITRE ATT&CK (67)

Vendors (48)

Products (125)

Tools (54)

Industries (54)

Countries (42)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.