Scattered Lapsus$ Hunters Snared in Cyber Researcher Honeypot

Scattered Lapsus$ Hunters, also known as ShinyHunters, were drawn into a researcher’s honeypot using what Resecurity described as synthetic data. The development was announced on 3 January as an update to a December post detailing how a threat actor probed Resecurity’s resources for sensitive company data. The honeypot used two datasets impersonating consumers and payments, plus generated messages, with data drawn from open sources including breached material from the Dark Web to make the scene more convincing.

According to Resecurity, the actors connected to a Gmail account, a Yahoo account and a US-based phone number, and the group bragged about breaching Resecurity while showing screenshots of the honeypot. The effort used old data from years past alongside AI-generated content and non-existent accounts, all hosted on a fake system emulated for the honeytrap. This information was provided to law enforcement after the attackers were identified.