'Scattered Lapsus$ Hunters,' Others Announce End of Hacking Spree

In a development that surprised many in the cybersecurity community, several well-known threat actors and groups, including the newly formed “Scattered Lapsus$ Hunters,” announced they were shutting down their operations.

The farewell letter, posted last week on BreachForums and the public Telegram channel, lists members from Lapsus$, Scattered Spider, ShinyHunters and others, and notes that “we LAPSUS$, Trihash, Yurosh, yaxsh, WyTroZz, N3z0x, Nitroz, TOXIQUEROOT, Prosox, Pertinax, Kurosh, Clown, IntelBroker, Scattered Spider, Yukari, and among many others, have decided to go dark.” Last month,

members of Scattered Spider, Lapsus$, and ShinyHunters joined under the new banner, with exploits on SAP NetWeaver Visual Composer vulnerabilities posted to their Telegram channel. The groups’ statement hints that some members intend to retire with their earnings, while others may pursue cybersecurity roles, though security researchers remain sceptical about the shutdown.

According to Reliaquest, there are signs of continued activity from Scattered Spider, including a rise in domains linked to finance-targeted activity and a recent intrusion against a US banking organisation, suggesting the threat persists despite claims to the contrary. Staying vigilant is urged as researchers say TTPs and IoCs associated with these groups continue to surface, indicating the threat remains active and evolving.