A Cybercrime Merger Like No Other — Scattered Spider, LAPSUS$, and ShinyHunters Join Forces

A new federated cybercrime entity has emerged, uniting Scattered Spider, LAPSUS$, and ShinyHunters under the banner SLH, with at least 16 Telegram channels created since 8 August 2025. Trustwave SpiderLabs, in a report shared with The Hacker News, noted that the channels have repeatedly been removed and recreated at least 16 times under varying iterations of the original name, reflecting moderation and the operators’ persistence.

SLH emerged in early August and has conducted data extortion attacks, including against organisations using Salesforce, offering an extortion-as-a-service to join the group’s brand and notoriety. The groups are said to be affiliated with a loose federation known as The Com, which also links to CryptoChameleon and Crimson Collective, and Telegram is described as the central coordination hub for this ecosystem.

Consolidated administrative personas include Shinycorp, UNC5537, UNC3944, and UNC6040, along with figures such as Rey, SLSHsupport, and yuka, who has a history as an initial access broker. In related developments, DragonForce—aligned with Scattered Spider and now partnering with Qilin and LockBit—has been described by Acronis researchers as enabling affiliates to deploy their own malware while using DragonForce’s infrastructure, effectively lowering barriers to entry for ransomware operations.