- Scattered Lapsus$ Hunters resurfaced claiming a breach at Resecurity
- Resecurity revealed it was a honeypot, tricking SLH into stealing pretend knowledge and exposing their infrastructure
- Investigators now have IPs, linked accounts, and timestamps shared with regulation enforcement, elevating prospects of arrests
After a number of months at midnight, the notorious Scattered Lapsus$ Hunters (SLH) are again to their common shenanigans. This time round, nonetheless, it might have been higher for them to have remained hidden.
For many who are unaware of SLH, this can be a hacking collective constituted of members of cybercriminal teams Scattered Spider, Lapsus$, and ShinyHunters.
They grew to become extensively standard in September 2025, once they claimed accountability for a significant breach at Jaguar Land Rover. This incident halted car manufacturing worldwide and drew big media consideration, due to its scale and impression – materializing into one of many costliest assaults in UK historical past.
The ‘gotcha’ second
Quickly after, they introduced their withdrawal, most likely to get out of the highlight. Earlier this week, although, they introduced breaking into the cybersecurity firm Resecurity:
“We want to announce that we now have gained full entry to Resecurity programs. We took all the things,” SLH stated on Telegram, Cybernews studies. They stated Resecurity acquired “totally owned”, dropping inner chats, worker knowledge, shopper lists, and different delicate data.
However it appears they fell for a reasonably subtle bait. Resecurity stated that this was, in truth, a honeypot full of pretend accounts, pretend knowledge, and faux content material:
“Following our publication, the group known as ShinyHunters, beforehand profiled by Resecurity, fell right into a honeypot. The truth is, we’re coping with its rebranded model, which calls itself SLH as a result of alleged overlap between the menace actors ShinyHunters, Lapsus$, and Scattered Spider,” the corporate stated.
“The group claimed that ‘it has gained full entry to Resecurity programs,’ which is a transparent overstatement, because the honeypot setting ready by us didn’t include any delicate data.”
The ramifications are fairly extreme for SLH. Resecurity has now uncovered the IP addresses they use and have been even in a position to “establish the actor and hyperlink considered one of his lively Gmail accounts to a US-based telephone quantity and a Yahoo account.” It’s not full-blown doxxing, however it’s the subsequent neatest thing.
“The exercise has been imaged and retained, together with precise timestamps and community connections, which have been shared with regulation enforcement.”
Now, let’s see if this growth results in any arrests and if, as some researchers declare, the group has minors as members.
By way of Cybernews
One of the best antivirus for all budgets
Comply with TechRadar on Google Information and add us as a most well-liked supply to get our knowledgeable information, opinions, and opinion in your feeds. Be sure to click on the Comply with button!
And naturally you can even observe TechRadar on TikTok for information, opinions, unboxings in video kind, and get common updates from us on WhatsApp too.
