Three Infamous Hacker Groups Join Forces as the ‘Scattered LAPSUS$ Hunters

Three of the cybercriminal heavyweights—Scattered Spider, ShinyHunters, and LAPSUS$—have formally aligned to form the Scattered LAPSUS$ Hunters (SLH), a federated collective that emerged in early August 2025. According to Trustwave’s SpiderLabs Blog, SLH combines reputational capital from existing groups with a centralised operational model that aims to sustain visibility and revenue under law enforcement and platform moderation pressure.

The alliance operates primarily through Telegram, using the platform as a performative marketing channel for breach announcements, victim exploitation, and operational branding, with high‑value targets including Salesforce and other SaaS providers. Evidence indicates fewer than five individuals drive the primary operation, with “shinycorp” among the principal orchestrators, and aliases such as “Alg0d,” “yuka,” and “UNC5537” expanding reach.

The group has signalled an Extortion-as-a-Service model and demonstrates exploit development, vulnerability brokerage, and targeted persistence capabilities, including claims of zero‑day exploitations such as CVE‑2025‑61882.