Security Industry Skeptical of Scattered Spider-ShinyHunters Retirement Claims

Security industry experts are skeptical about Scattered Spider and ShinyHunters claiming retirement, with many warning that the groups may still be active or rebrand under new names. SecurityWeek notes arrests, charges and sentences linked to Scattered Spider over the past year, and mentions that some attacks attributed to the two groups appear to have involved ShinyHunters, suggesting a merged operation rather than a true exit.

In online statements last week the groups said they were retiring, but analysts pointed out that such announcements are common under pressure from law enforcement and might simply indicate a pause rather than a departure. KELA told SecurityWeek that the groups posted a retirement message on Telegram on 18 August and then created a new channel on 28 August after deleting the old one.

Industry voices, including James Maude of BeyondTrust and others, argued that such groups are loosely connected and could disband and reform rather than quit, while Palo Alto Networks’ Sam Rubin cautioned that stolen data can resurface and backdoors persist even if operations pause. Written by Eduard Kovacs, the piece underscores that organisations should remain vigilant, as silence from threat actors does not equal safety. 16 September 2025.