Dark Web Profile: Scattered Lapsus$ Hunters

Dark Web Profile: Scattered Lapsus$ Hunters, published by SOCRadar, describes a mid-2025 campaign in which attackers intruded Salesforce environments across 91 organisations, including Adidas, Cartier, Google, Louis Vuitton, Dior, Chanel, Tiffany & Co., Qantas, Air France–KLM, Allianz, Cisco and Pandora.

The group is framed as a new alliance called Scattered Lapsus$ Hunters, uniting members of Scattered Spider, LAPSUS$, and ShinyHunters, which now operate jointly and publicly via a Telegram channel that was created on 8 August 2025 before being removed. Public statements from ShinyHunters suggested a division of labour, with Scattered Spider providing initial access, ShinyHunters handling data theft and publication, and LAPSUS$ acting as amplifiers and extortionists.

On 12 September 2025, the FBI issued a FLASH alert attributing Salesforce intrusions to two clusters—UNC6040 and UNC6395—both linked to Scattered Lapsu$ Hunters, with Google confirming the operation relied on social engineering, namely vishing and OAuth abuse, rather than Salesforce vulnerabilities.

The profile notes that attackers used methods such as calling employees to prompt MFA resets, deploying remote-management tools, and authorising malicious connected apps to gain long‑lived OAuth tokens, enabling access to CRM data.