A newly formed international cybercrime collective, known as Scattered Lapsus$ Hunters and also referred to as the “Trinity of Chaos,” has entered the threat landscape. First detected in August 2025, the group has already taken credit for multiple high-profile data breaches, including the theft of over 1 billion customer records from Salesforce.
The collective operates under two tracked campaigns, designated UNC6040 and UNC6395. Beyond the Salesforce incident, their claimed activities include breaching RedHat and publishing personal information of ICE officials in a doxxing operation.
Origins and Composition
According to posts on their Telegram channel, Scattered Lapsus$ Hunters asserts that it is formed from members of three established cybercriminal groups: Scattered Spider, Lapsus$, and ShinyHunters. This claimed merger has generated discussion among security researchers about the collective’s actual capabilities and future targets.
Operational Methods
The group demonstrates a notable willingness to conduct its extortion operations publicly. They use their website, BreachForums, to advertise their exploits and pressure victims into paying ransoms.
This open approach has contributed to their early successes, such as extracting sensitive data from major corporations. Scattered Lapsus$ Hunters also relies heavily on Telegram to claim responsibility for breaches and communicate with the public. By leveraging social media and online platforms, the group amplifies its message and increases pressure on targeted organizations.
This strategy has created a digital contest between the collective and its adversaries, with each side attempting to outmaneuver the other.
Implications for Cybersecurity
The emergence of this supergroup raises the stakes in the cybercrime ecosystem. Its international scope, extortion-focused business model, and public-facing tactics present significant challenges for law enforcement and cybersecurity professionals.
Authorities are now focused on tracking the group’s activities and anticipating its next moves. The collective’s ability to breach secure systems and extract sensitive data from major corporations underscores the threat it poses. Security experts are expected to develop new strategies and innovations in response to the group’s tactics.
As the situation evolves, the cat-and-mouse dynamic between Scattered Lapsus$ Hunters and those trying to stop them will continue to unfold.
Looking Ahead
Key questions remain about the group’s trajectory. It is unclear whether they will continue targeting major corporations for data extortion or shift focus to other objectives. The response from law enforcement and cybersecurity teams, and the effectiveness of countermeasures they deploy, will shape the next phase of this conflict.
The arrival of Scattered Lapsus$ Hunters has intensified the cyber threat environment, and significant developments are anticipated in the coming months.
Sources
- Scattered Spider, ShinyHunters Restructure – New Attacks Underway
- Secret CISO 10/5: Qantas, TransUnion Breaches; Salesforce Data…
