Three Infamous Hacker Groups Join Forces as the ‘Scattered LAPSUS$ Hunters

The report details the August 2025 formation of Scattered LAPSUS$ Hunters (SLH), a federated criminal collective merging Scattered Spider, ShinyHunters, and LAPSUS$ to pursue coordinated extortion, data-leak and exploit-driven campaigns against high-value SaaS and cloud targets; it describes SLH's Telegram-centric marketing, claims of zero-day capabilities (cited CVE-2025-61882 and CVE-2025-31324), affiliate-driven Extortion-as-a-Service operations, and attribution to a small set of core operators with demonstrated technical sophistication.