Sixteen times, Telegram has taken down the channels of Scattered LAPSUS$ Hunters. Sixteen times, the group has put them back up under a slightly altered name.
Trustwave SpiderLabs, a LevelBlue company, counted the cycle in a report shared with The Hacker News. “Since its debut, the group’s Telegram channels have been removed and recreated at least 16 times,” it said, a pattern it read as the operators’ “determination to sustain this specific type of public presence despite disruption.” The count starts August 8, 2025.
A merger, or a costume
The collective says it unites Scattered Spider, LAPSUS$ and ShinyHunters. It surfaced in early August and began data extortion attacks, including against organizations that use Salesforce. Its main offering is extortion as a service: affiliates pay to use the group’s brand and notoriety when they demand money from a victim.
All three groups are linked to The Com, a loose, decentralized criminal network marked by what Trustwave called “fluid collaboration and brand-sharing.” The actors have also shown ties to other clusters, CryptoChameleon and Crimson Collective.
Trustwave sounded a warning against taking the merger at face value. The new brand could be borrowing the old names, or impersonating them, to look united. At this stage there is no evidence of a “formal, centralized organization” made up only of the three.
The Telegram megaphone
Telegram remains the place where members coordinate and publicize their work, in a style close to hacktivist groups. The channels also advertise the group’s services. Admin posts came to carry signatures citing the “SLH/SLSH Operations Centre,” a label Trustwave said projected “the image of an organized command structure.”
Several known clusters sit under the umbrella:
Shinycorp, also known as sp1d3rhunters, coordinates the group and manages its brand. UNC5537 is tied to the Snowflake extortion campaign. UNC3944 is associated with Scattered Spider. UNC6040 is linked to the recent Salesforce vishing campaign. Identities named Rey and SLSHsupport keep up engagement, and yuka, also called Yukari or Cvsp, has a history of developing exploits and presents as an initial access broker.
Data theft and extortion remain the core business. The actors have also teased a custom ransomware family, Sh1nySp1d3r, to compete with LockBit and DragonForce. Trustwave places them somewhere between financially motivated crime and attention-seeking hacktivism.
DragonForce and Scattered Spider
Separately, Acronis reported that DragonForce operators have released a new malware variant. It abuses vulnerable drivers, truesight.sys and rentdrv2.sys among them, to shut down security software in a bring-your-own-vulnerable-driver attack. DragonForce launched a ransomware cartel earlier this year and has partnered with Qilin and LockBit. Acronis says Scattered Spider acts as an affiliate, breaking in through spear-phishing and vishing and then using remote tools such as ScreenConnect, AnyDesk, TeamViewer and Splashtop before the ransomware lands.
Serhii Melnyk, a threat intelligence analyst at Trustwave, called the link “affiliate-level overlap” rather than a formal alliance: recurrent but opportunistic and transactional. He pointed to late April and early May 2025, when UK retailers including Marks & Spencer, Co-op and Harrods were hit with Scattered Spider-style social engineering followed by DragonForce payloads. Scattered Spider has also worked with BlackCat, RansomHub and Qilin, he said, with “no indication of a formal or enduring alliance.”
