Researchers Map Links Between Major Hacker Groups: LAPSUS$, Scattered Spider, ShinyHunters

Researchers map links between LAPSUS$, Scattered Spider and ShinyHunters, describing a loosely connected cybercrime supergroup that uses shared tactics, overlapping membership and public channels to coordinate extortion and data leaks.

From 2023 through 2025 there is evidence of direct collaboration on high-profile breaches and a push to market a combined Ransomware-as-a-Service offering, including a Telegram channel discovered in August 2025 uniting the three groups under the “shinysp1d3r” branding to coordinate threats and sell RaaS subscriptions.

ShinyHunters admitted Scattered Spider provided initial network access while its members handled bulk data exfiltration, with LAPSUS$ operatives also participating, collectively targeting Salesforce, Snowflake and other major platforms. On 12 September the FBI issued a FLASH alert on UNC6040 and UNC6395, groups tied to these alliances, for exploiting Salesforce environments to steal sensitive records; many Fortune 100 victims reported extortion emails signed by ShinyHunters confirming coordinated attacks.

The piece notes the groups are part of “The Com,” emphasising the fluid threat landscape and the need for continued threat intelligence sharing and human-centric defence.