Trustwave Confirms ‘Trinity of Chaos’ Alliance: Scattered LAPSUS$ Hunters Form EaaS Supergroup

According to Trustwave SpiderLabs’ Cyber Threat Intelligence team, researchers have identified the formation of a federated threat alliance uniting Scattered Spider, ShinyHunters, and LAPSUS$ under a single banner known as Scattered LAPSUS$ Hunters (SLH). The group, emerging in early August 2025 and surfacing on Telegram, presents itself as a hybrid entity combining traits from the three founding collectives and has quickly launched its own Extortion-as-a-Service (EaaS) model.

Trustwave notes that SLH uses a public encryption communication service as its primary operating base and allows EaaS affiliates to leverage the member names to intimidate victims and demand higher ransoms. The operation is described as highly performative, with Telegram posts, polls, and doxxing campaigns used to build engagement, and SLH’s channels have been removed and recreated more than sixteen times.

The report identifies “shinycorp” as the principal orchestrator, with other figures such as “Alg0d” and “Yukari/Cvsp” playing key roles; the group’s exploits include CVE-2025-61882 and CVE-2025-31324.