Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand

Trustwave SpiderLabs reports the emergence of Scattered LAPSUS$ Hunters (SLH), a federated cybercriminal brand that consolidates reputational assets from previous groups to provide Extortion-as-a-Service and public data-leak operations. SLH operates primarily on Telegram, uses theatrical messaging and social amplification, and targets high-value cloud aggregation points (SaaS, CRMs, DBMS) via credential harvesting (vishing/spearphishing), lateral movement, and claimed exploit acquisition/development (including alleged zero-days), while some technical claims remain unverified.