Scattered Lapsus$ Hunters

☆ pin

Also known as Scattered Lapsus Hunters, Scattered LAPSUS$ Hunters, Scattered Lapsus$

Reports

First seen

Feb 2, 2026

Last seen

Oct 3, 2026

Motivation

Financial

Targeting

Sectors

Other ×2

Top ATT&CK techniques

T1021 Remote Services ×3T1190 Exploit Public-Facing Application ×3T1195 Supply Chain Compromise ×3T1566 Phishing ×2T1041 Exfiltration Over C2 Channel ×2T1567 Exfiltration Over Web Service ×2T1498 Network Denial of Service ×2T1486 Data Encrypted for Impact ×2T1005 Data from Local System ×2T1218 System Binary Proxy Execution ×1T1187 Forced Authentication ×1T1003 OS Credential Dumping ×1

Indicators

cve ×10domain ×3filename ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-44228 (exploited)CVE-2025-53690 (exploited)CVE-2025-55182 (exploited)CVE-2025-59528 (exploited)CVE-2025-64155 CVE-2025-8088 (exploited)CVE-2026-1281 (exploited)CVE-2026-20045 (exploited)CVE-2026-21509 (exploited)CVE-2026-32201 (exploited)CVE-2026-35616 (exploited)

Recent reports

High

ShinyHunters member Rey detained in Jordan, cooperating with FBI

Bleeping ComputerOct 3, 2026 High

Out of the Crypt: The Evolving Cyber Extortion Economy

Palo Alto Unit 42May 28, 2026 High

CERT-EU Cyber Brief April 2026 – Espionage, Supply-Chain Attacks, and Critical Infrastructure Threats

CERT-EU Threat IntelMay 4, 2026 High

CERT-EU Cyber Brief January 2026 – Espionage, Ransomware, and Critical Vulnerabilities

CERT-EU Threat IntelFeb 2, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.