Krebs on SecurityBrianKrebs
Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’
The article discusses the cybercriminal group "Scattered LAPSUS$ Hunters" (SLSH), which has gained notoriety for extorting major corporations by stealing data. The group's public face, known as "Rey," revealed his identity after being contacted by KrebsOnSecurity. SLSH is believed to be a combination of three hacking groups and has employed social engineering tactics to infiltrate organizations, notably using voice phishing to access Salesforce data.
They have launched a data leak portal threatening to publish stolen information from companies like Toyota and Disney unless ransoms are paid. SLSH is also recruiting insiders from large companies to facilitate their attacks. Rey, a key member, has released a new ransomware-as-a-service called "ShinySp1d3r" and has a history of operational security mistakes that led to his identification. He is reportedly trying to distance himself from cybercrime and has been in contact with law enforcement.
Story timeline Scattered Lapsus Hunters
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 26 Nov 2025 · 17:50 UTC | Krebs on Security | Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’ (this article) |
| Wed 29 Apr · 11:32 UTC | Ars Technica | Trivy Supply Chain Attack Hits Checkmarx, Bitwarden via TeamPCP |
| Mon 27 Jul · 19:31 UTC | DataBreaches | Frontier Airlines faces third breach as security flaws linger |