Scattered LAPSUS$ Hunters Pivot to EaaS, Launch Insider Recruitment Campaign After Salesforce Extortion

Researchers at Palo Alto Networks’ Unit 42 have observed a surge in activity from Scattered LAPSUS$ Hunters, a cybercrime group linked to the Bling Libra syndicate, signalling a strategic pivot toward extortion-as-a-service operations and renewed insider recruitment campaigns, according to Unit 42’s analysis. The findings detail how the group is building on its Salesforce data theft extortion campaign while experimenting with new monetisation models and even hinting at a new ransomware called SHINYSP1D3R.

On 10 October 2025, just hours before their ransom deadline, the group publicly teased the launch of an extortion-as-a-service platform, an apparent rebranding of ransomware-as-a-service but without file encryption. The group revived its insider access recruitment programme on 5 October 2025, seeking employees willing to sell access credentials across multiple industries.

Unit 42 notes the insiders target call centres, gaming companies, hosting providers, SaaS and telecom organisations in the US, UK, Australia, Canada and France, with a possible link to earlier Muddled Libra campaigns.