Scattered LAPSUS Hunters Escalate With New Channel and Gainsight Breach

Scattered LAPSUS Hunters (SLH) have resurfaced with a new Telegram channel and broader public provocations, framing themselves as a unified brand that includes Scattered Spider, LAPSUS$, and ShinyHunters. Early posts claim that about 300 organisations have been compromised and that their activity has generated higher revenue than several well-known ransomware groups.

A majoralert involves Gainsight, where Salesforce published a security advisory stating that unusual activity was detected in Gainsight-published applications, tied to external third-party connections rather than the Salesforce platform itself; Salesforce revoked tokens and removed affected apps from the AppExchange during the investigation. Gainsight has engaged Mandiant for forensic support and noted that customers can request specific IP ranges and subnets used by the Gainsight Connector.

SLH asserts that the combined Salesloft/Drift and Gainsight breaches will balloon their data-leak site to nearly 1,000 organisations, including Verizon, GitLab, F5, and SonicWall, with a planned Ransomware-as-a-Service programme slated to begin on 24 November.