Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Golden Scale: Bling Libra and the Evolving Extortion Economy

Summary: Threat actors calling themselves Scattered Lapsus$ Hunters, a conglomerate tied to Muddled Libra, Bling Libra and LAPSUS$, claim to have stolen more than 1 billion Salesforce records across two campaigns and launched a data leak site on Oct. 3, 2025 naming 39 global organizations with an Oct. 10, 2025 ransom deadline. Bling Libra told Bleeping Computer it has operated as an extortion-as-a-service provider taking a 25-30% revenue share, and on Oct. 9, 2025 the FBI seized the domains associated with BreachForums, which hosted the new leak site, though Bling Libra said no core members were arrested and its darknet site was unaffected.

What's compelling: Bling Libra's EaaS model takes a 25-30% cut and skips ransomware encryption entirely, which may be why it draws less law enforcement attention than RaaS - and why retail and hospitality victims face customer identity theft, loyalty rewards fraud and erosion of consumer trust heading into peak shopping season.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Data Breaches
Related