The Federated Threat: Analyzing Scattered LAPSUS$ Hunters and CVE-2025-61882

Estimated reading time: 10 minutes

Key takeaways:

  • Scattered LAPSUS$ Hunters (SLH) is a consolidated cybercriminal entity.
  • SLH leverages the reputations of Scattered Spider, ShinyHunters, and LAPSUS$.
  • The group actively uses Telegram as a marketing and public messaging platform.
  • SLH demonstrates technical versatility, prioritizing cloud-first extortion and data theft.
  • Ensure timely patching of vulnerabilities, especially CVE-2025-61882.

Table of contents:

Scattered LAPSUS$ Hunters: A Federated Cybercriminal Brand

Trustwave SpiderLabs has identified a concerning trend: the consolidation of established threat groups into a “federated alliance” offering Extortion-as-a-Service (EaaS). This alliance, known as Scattered LAPSUS$ Hunters (SLH), leverages the reputations of Scattered Spider, ShinyHunters, and LAPSUS$ to instill fear and potentially increase financial gains. The group’s primary operating base is a public encryption communication service, enabling its affiliates to use the well-known names of its members.

Launch of the Consolidated Threat Group

SLH surfaced in early August 2025 on Telegram, presenting itself as a hybrid entity that combines the reputations and operational methods of Scattered Spider, ShinyHunters, and LAPSUS$. These groups are connected to an informal cybercriminal milieu known for fluid collaboration and brand-sharing. SLH has also displayed affiliations with other adjacent clusters, such as CryptoChameleon and Crimson Collective.

The first verified channel linked to SLH appeared on August 8, 2025, under the handle “scattered lapsu$ hunters – The Com HQ SCATTERED SP1D3R HUNTERS.” Telegram serves as the group’s primary operational environment and the core of its brand identity. While SLH has used clear-web and onion-based data leak sites for limited proof-of-compromise (PoC) materials, Telegram remains central to its narrative.

Many threat actors use Telegram for advertising or communication. However, SLH actively uses Telegram as a marketing and public messaging platform, a style more typical of hacktivist groups. Financially motivated actors generally seek the minimum visibility needed to manage victims and payments.

SLH administrative posts began to include signatures referencing the “SLH/SLSH Operations Centre,” projecting an image of an organized command structure.

Operational Persistence and Platform Cycles

Since its emergence, SLH’s Telegram channels have been removed and recreated at least sixteen times, reflecting platform moderation and the group’s determination to maintain its public presence. The group’s resilience is evident in its adaptive naming and coordinated re-establishment of channels.

SLH’s arrival coincided with turbulence in the cybercriminal underground, specifically the collapse of BreachForums. SLH repackaged reputational assets from defunct collectives and inherited fragments of their audiences, reasserting legitimacy within the network. The group then announced an Extortion-as-a-Service (EaaS) model, signaling its operational ambition.

SLH positions itself as a performer and service provider, using spectacle to attract customers, attention, and recruits.

Narrative Patterns and Messaging Themes

SLH channels combine sensationalist rhetoric with theatrical claims of data theft, fusing entertainment with intimidation. Posts often accuse Chinese state actors of exploiting vulnerabilities targeted by SLH, while mocking Western law enforcement agencies.

Channel content alternates between proof-of-compromise displays, interactive polls, and coercive messaging. Snippets of leaked data serve as teasers, while polls invite participation in harassment or doxing campaigns. Occasional monetary incentives blur the line between recruitment and crowdsourced extortion.

Parallel sales posts offer stolen credentials and exploits. Although data exfiltration and extortion are its main revenue channels, recurring mentions of “Sh1nySp1d3r Ransomware” indicate aspirations toward ransomware operations.

These patterns show a deliberate fusion of technical signaling and social performance. While financial gain is the main motivation, the group’s reliance on attention and social validation suggests social dependence. This positions SLH between financially motivated cybercrime and attention-driven hacktivism, blending monetary incentives with performative behavior.

There is no clear evidence that SLH targets fall within a traditional hacktivist realm. Their behavior is unusual for purely financially motivated actors, but their posts and campaigns do not convey any coherent social agenda.

Persona Architecture and Sockpuppetry

Behind the narrative lies a more controlled reality. Linguistic patterns and posting cadence suggest that fewer than five individuals drive the core operation.

Among these, “shinycorp” functions as the principal orchestrator. “Alg0d” operates as a broker persona, focused on data sales and negotiation. Auxiliary identities amplify narratives and sustain channel engagement.

“yuka” presents itself as an exploit or initial access broker (IAB) and has been associated with offers of zero-day vulnerabilities. Available evidence suggests that Cvsp’s technical proficiency is genuine, spanning exploit development, malware engineering, and vulnerability brokerage. Previous associations with the BlackLotus UEFI bootkit and Medusa rootkit lend credibility to this assessment.

Each consistently active persona acts as an amplifier and a shield, complicating attribution. SLH frames itself as part of a loosely federated community rather than a fixed hierarchy.

Tactics, Techniques, and Procedures (TTPs)

SLH demonstrates technical versatility, prioritizing cloud-first extortion and data theft, focusing on high-value aggregation points such as SaaS providers, corporate CRMs, and other large data lakes.

This proficiency reflects a convergence of skills drawn from multiple merged clusters, suggesting that SLH leverages expertise across intrusion, exploitation, and social engineering.

Credential harvesting, often through AI-automated vishing or spearphishing, is followed by lateral movement for privilege escalation, persistence, and data exfiltration.

SLH exhibits exploit development and acquisition capabilities, including tooling that resembles zero-day research targeting CRMs and SaaS platforms.

Affiliated posts have claimed multiple corporate compromises, most notably CVE-2025-61882 (Oracle E-Business Suite), a vulnerability widely associated with Cl0p ransomware operators.

Historical references support the continuity of this focus: the persona Yukari previously claimed exploitation of Oracle Access Manager in 2021.

These behaviors illustrate an operational structure that combines social engineering, exploit development, and narrative warfare.

Practical Takeaways

For Technical Readers:

  • Implement and maintain a cyber threat intelligence platform to stay informed about emerging threat actors and their TTPs.
  • Conduct real-time ransomware intelligence gathering to identify and mitigate potential ransomware threats.
  • Utilize a dark web monitoring service to detect compromised credentials and sensitive information.
  • Monitor Telegram and underground forums for threat actor discussions and leaked data.
  • Implement breach detection systems and supply-chain risk monitoring to identify and prevent supply chain attacks.
  • Use brand leak alerting to monitor for unauthorized use of your organization’s branding.
  • Ensure timely patching of vulnerabilities, especially those associated with active exploitation, such as CVE-2025-61882.

For Non-Technical Readers:

  • Understand the evolving threat landscape and the potential impact of cybercriminal groups like Scattered LAPSUS$ Hunters.
  • Promote a security-aware culture within the organization, emphasizing the importance of strong passwords and multi-factor authentication.
  • Ensure that your organization has an incident response plan in place to effectively handle security breaches.
  • Invest in employee training to recognize and avoid phishing attempts and social engineering tactics.
  • Regularly review and update security policies and procedures to align with the latest threat intelligence.
  • Consider using a cyber threat intelligence platform to stay ahead of potential threats.

PurpleOps and Federated Threat Intelligence

The emergence of groups like Scattered LAPSUS$ Hunters highlights the importance of comprehensive cyber threat intelligence. PurpleOps offers solutions designed to help organizations proactively identify and mitigate these threats, including:

  • Cyber Threat Intelligence Platform: Aggregates and analyzes threat data from various sources, providing actionable insights into emerging threats and vulnerabilities.
  • Dark Web Monitoring Service: Monitors dark web forums and marketplaces for stolen credentials, leaked data, and threat actor discussions.
  • Underground Forum Intelligence: Provides access to intelligence gathered from underground forums, offering insights into threat actor tactics and intentions.
  • Real-time Ransomware Intelligence: Provides up-to-the-minute information on ransomware threats, including indicators of compromise and decryption keys.
  • Breach Detection: Identifies and alerts organizations to potential data breaches and security incidents.
  • Telegram Threat Monitoring: Scans Telegram channels for threat-related content, including discussions about potential attacks and data leaks.
  • Supply-Chain Risk Monitoring: Assesses the security posture of third-party vendors and suppliers to identify and mitigate supply chain risks.
  • Brand Leak Alerting: Monitors for unauthorized use of your organization’s branding and intellectual property online.

Conclusion

SLH likely represents the first consolidated alliance among clusters within its network, unifying extortion, brokerage, and influence operations under a cohesive narrative. This consolidation underscores an emerging trend toward professionalized cybercriminal branding, where control of narrative and audience engagement function as strategic assets.

As this hybrid ecosystem evolves, its use of identity fluidity, social amplification, growing tailored exploitation development capabilities, and adaptive collaboration will likely shape the next phase of data-extortion activity. Understanding this interplay between performance, persistence, and perception will be essential for anticipating how such threat collectives sustain momentum.

To learn more about how PurpleOps can help you protect your organization from emerging cyber threats, visit PurpleOps Platform or contact us at PurpleOps Solutions.

FAQ

Q: What is Scattered LAPSUS$ Hunters (SLH)?

A: SLH is a consolidated cybercriminal entity leveraging the reputations of Scattered Spider, ShinyHunters, and LAPSUS$ to conduct Extortion-as-a-Service (EaaS) operations.

Q: What is CVE-2025-61882?

A: CVE-2025-61882 is a vulnerability in Oracle E-Business Suite that has been associated with Cl0p ransomware operators and is being exploited by SLH.

Q: How does SLH use Telegram?

A: SLH actively uses Telegram as a marketing and public messaging platform to advertise their services, share proof-of-compromise, and engage with potential recruits and victims.