The Golden Scale: Notable Threat Updates and Looking Ahead

According to Unit 42, the Scattered LAPSUS$ Hunters group has continued to push updates via their Telegram channel, including notices around the Salesforce data theft extortion activity and related discussions in the SLSH 6.0 part 3 channel.

The group set a self-imposed ransom deadline of 11:59 PM ET on 10 October 2025, and subsequent news reports have said that data allegedly belonging to six companies was leaked across aviation, energy and retail sectors, with leaked PII such as names, dates of birth, email addresses, phone numbers and frequent flyer numbers. Unit 42 noted that on 11 October 2025 the threat actors stated that “nothing else will be leaked,” a message whose meaning remains unclear.

The article also highlights potential activity gaps into the new year, and the launch of an extortion-as-a-service program announced on 10 October 2025, which claims to avoid file encryption in a bid to evade law enforcement. Recruitment advertisements seeking insider access surfaced on 5 October 2025, targeting call centres, gaming firms, hosting providers, SaaS and telecom organisations across the US, UK, Australia, Canada and France. The piece also discusses a potential new ransomware form named “SHINYSP1D3R” mentioned in October 2025, though its development status remains uncertain.