Going Dark: ShinyHunters/ScatteredSpider/LAPSUS$ Say Goodbye

On September 8, the “scattered LAPSUS$ hunters 4.0” Telegram channel posted a message criticising law enforcement and claiming arrests had been made in France, with the arrested person described as missing for hours and the post noting that authorities would not make official announcements.

Shortly afterwards, another post declared that “This channel is now closed and we’re going away for a while… But now we learn that ‘a while’ means ‘forever’.” In a follow‑up statement on BreachForums, the group claimed to have spoken after a period of silence and to be abandoning many of their tools, stating that they have decided to go dark and that their objectives having been fulfilled, it is time to say goodbye.

The message references multiple groups, including LAPSUS$, Trihash, Yurosh, Kurosh, Clown, IntelBroker, Scattered Spider, Yukari, and others, and mentions that eight people had been raided or arrested since April 2024, with four in custody in France. It also raises questions about potential data breaches affecting Kering, Air France, American Airlines, and British Airlines, describing a continuing awareness of ongoing activity while authorities act. According to DataBreaches, the post also hints at ongoing disinformation and describes a vow of silence as their new strength.