Researchers Trap Scattered Lapsus$ Hunters in Honeypot

Researchers have trapped the Scattered Lapsus$ Hunters in a honeypot devised by Resecurity, exposing data about their attack servers. In early January the group boasted on Telegram about hacking Resecurity, only to find they had walked into a trap that had been prepared since November, when the trap was set after noticing probes of public-facing services.

The honeypot used synthetic data, a fake account on an underground marketplace, and an emulated environment to lure the attackers, with over 28,000 consumer records and over 190,000 payment transaction records fed in from breached data on the Dark Web. Between 12 and 24 December the threat actor made more than 188,000 requests to dump synthetic data, while researchers monitored TTPs and identified server IPs, including two in Egypt, following proxy failures.

The effort also involved sharing information with law enforcement and ISPs, and a subpoena was issued; the activity allegedly included a Honeytrap domain and a Mattermost application created for the honeytrap account “Mark Kelly” around November 2025. According to Resecurity, the attackers claimed they had breached the firm, but the evidence showed the opposite.