Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’
Summary: KrebsOnSecurity identified "Rey," the public face and technical operator of Scattered LAPSUS$ Hunters, as Saif Al-Din Khader, a Jordan-based teenager who turns 16 next month, after tracing an unredacted 15-character password in a Telegram screenshot to an email address exposed by infostealer malware. Rey, one of three administrators of the SLSH Telegram channel, released the group's ShinySp1d3r ransomware-as-a-service offering, which he said is Hellcat ransomware modified with AI tools, and claimed he has been cooperating with law enforcement since at least June.
What's compelling: The group behind voice-phishing attacks on Salesforce portals and a leak site naming Toyota, FedEx, Disney/Hulu and UPS was run in part by a teenager on a shared family PC in Amman, and it is now recruiting insiders at large companies to hand over network access for a cut of ransom payments.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026