On 8 August 2025, three well‑known cyber‑criminal outfits – Scattered Spider, Lapsus$, and ShinyHunters – announced that they would operate as a single collective. The alliance has already set up at least 16 Telegram channels that serve as public command hubs for coordinating attacks.
Scattered Spider, also identified as UNC3944 and recently linked to ShinyHunters, is primarily composed of teenagers and young adults believed to reside in the United States and the United Kingdom. The group is loosely affiliated with “The Com,” an informal online subculture known as Hacker Com where emerging hackers exchange techniques, flaunt breaches, and plan operations. Scattered Spider first attracted attention in 2023 after breaching Caesars Entertainment and MGM Resorts International. The MGM intrusion crippled hotel key‑card systems, casino floor machines, and reservation platforms across the chain, while Caesars chose to pay a ransom.
Since then, the crew has targeted a string of high‑profile victims, including Visa, Marks & Spencer, PNC Financial Services, Transamerica, New York Life Insurance, Synchrony Financial, Truist Bank, Twilio, and Jaguar Land Rover. Their typical playbook involves social‑engineering tactics to gain initial footholds, followed by lateral movement within networks and extortion demands.
Lapsus$, another youth‑driven group, has focused on technology firms. Its most publicized intrusions hit Microsoft, Okta, NVIDIA, and Samsung. Rather than deploying sophisticated malware, Lapsus$ relied on bribing call‑center or telecom employees to obtain SIM‑swap capabilities or password resets, using phone calls and chat messages to execute the breaches.
Although members were arrested in the United Kingdom and Brazil, the group never fully dissolved. ShinyHunters specializes in mass data theft and resale.
The gang has exfiltrated databases from platforms such as Wattpad, Tokopedia, and Microsoft’s GitHub, then moved the stolen information onto dark‑web marketplaces where it is traded as a commodity. The recent identification of ShinyHunters as the same entity behind Scattered Spider blurs the line between extortion, data theft, and hacktivist activity. Evidence also ties Scattered Spider to attacks on Snowflake cloud‑storage customers in the United States, affecting companies like Ticketmaster and Santander Bank, and to a high‑profile compromise of Qantas, Australia’s flag carrier – a target outside the typical scope of American‑based teenage hackers.
The formation of the collective merges distinct capabilities: Scattered Spider contributes social‑engineering and extortion expertise; Lapsus$ adds telecom‑infiltration methods; and ShinyHunters provides a ready‑made infrastructure for monetizing stolen data. By sharing resources and knowledge through the newly created Telegram channels, the alliance can coordinate more efficiently than any of the groups could alone.
Cybersecurity analysts warn that this coalition marks a shift in the threat landscape. While each group was already dangerous in isolation, their combined skill set creates a more versatile adversary capable of targeting a broader range of sectors. The youthful composition of the crews adds an element of unpredictability, as reputation within “The Com” appears to drive actions as much as financial gain, potentially encouraging reckless or highly destructive attacks.
The public nature of the August 8 announcement – coupled with openly broadcast Telegram channels – signals a desire for visibility and intimidation. The message is unmistakable: three of the most active cyber‑crime entities are now operating together, and their target list is poised to expand beyond casinos, banks, airlines, and cloud providers.
No industry can consider itself insulated from this emerging, collaborative threat.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Notorious Cybercrime Groups Unite to Form Powerful Collective Entity”, “description”: “On 8 August 2025, three well‑known cyber‑criminal outfits – Scattered Spider, Lapsus$, and ShinyHunters – announced that they would operate as a single collecti”, “datePublished”: “2026-06-23T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Arjun Mehta”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}, “image”: “https://infopulsetoday.com/wp-content/uploads/sites/3/rehomed/s23/2026/06/companion_7180.jpg”}
