The Golden Scale: Bling Libra and the Evolving Extortion Economy

According to Unit 42, Scattered Lapsus$ Hunters (aka SP1D3R HUNTERS, SLSH) have claimed responsibility for attacks on Salesforce tenants as part of a broader extortion campaign, with the group described as a potential Trinity of Chaos linking Muddled Libra, Bling Libra and LAPSUS$.

They claim to have stolen more than 1 billion Salesforce records across two campaigns, and on 3 October 2025 they launched a data leak site, giving victims until 10 October 2025 to pay, while recruiting other actors to help send extortion notes. The group’s activity overlaps with Bling Libra, which has operated as an extortion-focused EaaS provider, differentiating itself from ransomware by not encrypting data and instead focussing on data theft and public exposure.

Crim son Collective has also been linked to Red Hat and AWS-targeted data theft and begun posting victims alongside Scattered Lapsus$ Hunters, according to the piece. After the FBI seized the BreachForums domains on 9 October 2025, Bling Libra signalled the darknet DLS remained active, and the article notes a wider shift towards EaaS in the extortion economy.

The piece highlights risks for retail and hospitality organisations and urges defensive steps such as automated secret-scanning tools and ISAC membership, with the Unit 42 Incident Response team available for assistance.