“Our objectives having been fulfilled, it is now time to say goodbye,” the hackers wrote. Some, they added, would “enjoy our golden parachutes with the millions the group accumulated.” Others would “just go gentle into that good night.”
The farewell came in early September from the “Trinity of Chaos,” a loose alliance of three English-speaking cybercrime groups: LAPSUS$, ShinyHunters and Scattered Spider. Analysts say the goodbye did not take. Their hallmark techniques have shown up again in fresh attacks and extortion emails.
Who they hit
A report by the security firm Resecurity says the three groups have targeted Qantas, Allianz Life, Adidas and Google since joining forces. Resecurity found evidence of “connections, tactical overlaps, and even direct collaboration” among them about a year ago. Activity ramped up through the middle of this year, with attacks on airlines and big retailers.
Members claimed the Qantas breach in July 2025, which exposed more than 6 million customers. Marks & Spencer, struck in April 2025, paused online orders and was still dealing with the attack in July. The company expected a 300 million British pound ($610 million) hit to its profits this year. The incident was tied to Scattered Spider, which allegedly broke into MGM Resorts and Caesars Entertainment in 2023 and partly paralysed their casinos.
“There have been 91 victims in total claimed by the group,” said David Tuffley, a cybersecurity expert at Griffith University. “They are really levelling up their game.”
Phone calls, not exploits
The members are believed to be mostly teenagers and young men, native English speakers spread across the globe. Sigi Goode, a professor of information systems at the Australian National University, called them “digital natives.” Their methods are not especially new. They are well coordinated, though, and their language skills help.
The main weapon is social engineering: voice phishing, ordinary phishing, posing as IT staff. At Qantas and Marks & Spencer, hackers rang call-centre employees at a third-party contractor and talked them into handing over passwords or multi-factor authentication codes. Pandora, Adidas, Chanel, Tiffany & Co. and Cisco were also hit with social engineering. A phone call was enough to walk away with millions of customer records.
Another tactic is MFA fatigue, where attackers flood a user’s device with prompts until the person approves one out of exhaustion.
Jennifer Medbury, a lecturer in intelligence and security at Edith Cowan University, said cloned voices and generative AI make the calls harder to spot. “By doing it on an AI, you don’t need to have a person making the call,” she said. Once the script is set, attackers could be “ringing hundreds of people simultaneously.”
Leak sites and polls
After stealing data in bulk, the groups threaten to publish it. Resecurity said their extortion “often involve[s] public shaming, leak sites, and direct communication with victims,” and that the collective has “gamified data leaks, using public polls to decide which victim’s data to release next.”
Resecurity published emails the criminals sent Qantas, with samples of the stolen data. Qantas told the ABC it took “immediate steps and contained the incident” and had no evidence the data had been released.
A handful of arrests over the past year drew mockery in the retirement letter. “Have they not realised we were everywhere?” the hackers wrote. Tuffley called the letter a “ruse.” “What they always seem to do is regroup,” he said.
Researchers have linked new attacks on financial services firms to Scattered Spider. Resecurity said it knows of multiple undisclosed victims “currently being extorted privately.”
Tuffley’s advice is to use phishing-resistant multi-factor authentication, which sends codes through apps rather than SMS, and a zero-trust setup in which everyone is always verified. Staff at third-party contractors need training too. “You make sure that your entire supply chain upstream and downstream are secure,” he said.
