Please Don’t Feed the Scattered Lapsus Shiny Hunters
Summary: Scattered Lapsus ShinyHunters (SLSH) is an English-language extortion gang that breaks into companies by phoning employees while posing as IT staff and directing them to credential-harvesting sites that capture SSO credentials and MFA codes, then registers its own device for MFA, according to a January 30 Mandiant blog post covering intrusions from early to mid-January 2026. Unit 221B director of research Allison Nixon says the group escalates beyond data extortion to swatting executives, threatening their families and boards, DDoS attacks, email-flooding, and notifying journalists and regulators, and that its members come from The Com, a set of Discord and Telegram crime communities prone to feuds and betrayals.
Bottom line: Unit 221B's position is that negotiating only raises the level of harm, and that the harassment and the payment decision should be treated as separate issues - a hard call for a board watching executives and their families get swatted.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026