Flare analysis separates Scattered Spider, LAPSUS$ and ShinyHunters as distinct intrusion clusters within The Com
A Flare analysis argues that Scattered Spider, LAPSUS$ and ShinyHunters are distinct intrusion clusters within The Com, a decentralized, mostly English-speaking cybercriminal subculture, and not interchangeable names for one group. It describes SP1D3R HUNTERS (also called Scattered LAPSUS$ Hunters, SLH) as a shared brand and coordination layer rather than a fourth operational group. Shared members, overlapping social engineering and participation in the same channels do not prove that separate operations come from the same actor. Collapsing them into one identity can misdirect investigations, distort executive reporting and lead defenders to prioritize the wrong attack patterns.
Technical Details
- Scattered Spider (tracked as UNC3944, Octo Tempest, Muddled Libra) targets enterprise identity workflows. Operators impersonate employees or support staff, manipulate password resets, transfer MFA enrollment, and use SIM swapping or repeated authentication prompts. A joint CISA advisory documents follow-on use of legitimate remote management software, attacker-controlled MFA registrations, internal reconnaissance and data exfiltration. Microsoft documents DragonForce ransomware deployment against VMware environments.
- LAPSUS$ (Microsoft: DEV-0537) had a public operational window of December 2021 to September 2022 according to Flare, which assesses the group as defunct. Its model centered on data exfiltration, extortion and destruction without ransomware payloads, relying on insider recruitment, compromised accounts and social engineering. Later attacks should not be attributed to it just because its name or techniques are reused.
- ShinyHunters-branded activity spans cloud and SaaS intrusions. Google separates Salesforce-focused voice phishing (UNC6040) from the later extortion (UNC6240), and its January 2026 research tracks ShinyHunters-branded activity across UNC6661, UNC6671 and UNC6240, reflecting evolving partnerships and possible impersonation.
- Flare argues this structure explains why arrests disrupt individual operators without eliminating the ecosystem. Continued use of a name alone does not demonstrate operational continuity.
Remediation
- Correlate infrastructure, identity telemetry, forensic artifacts and independently supported actor links before naming a group.
- Follow CISA guidance: deploy phishing-resistant MFA, control remote access software and monitor for account misuse.
- Keep observed behavior, assessed cluster membership and criminal branding separate in incident reporting and remediation planning.
Linha do tempo
-
Flare analysis separates Scattered Spider, LAPSUS$ and ShinyHunters as distinct intrusion clusters within The Com
ler a análise desta fonte ocultar
A Flare analysis argues that Scattered Spider, LAPSUS$ and ShinyHunters are distinct intrusion clusters within The Com, a decentralized, mostly English-speaking cybercriminal subculture, and not interchangeable names for one group. It describes SP1D3R HUNTERS (also called Scattered LAPSUS$ Hunters, SLH) as a shared brand and coordination layer rather than a fourth operational group. Shared members, overlapping social engineering and participation in the same channels do not prove that separate operations come from the same actor. Collapsing them into one identity can misdirect investigations, distort executive reporting and lead defenders to prioritize the wrong attack patterns.
Technical Details
- Scattered Spider (tracked as UNC3944, Octo Tempest, Muddled Libra) targets enterprise identity workflows. Operators impersonate employees or support staff, manipulate password resets, transfer MFA enrollment, and use SIM swapping or repeated authentication prompts. A joint CISA advisory documents follow-on use of legitimate remote management software, attacker-controlled MFA registrations, internal reconnaissance and data exfiltration. Microsoft documents DragonForce ransomware deployment against VMware environments.
- LAPSUS$ (Microsoft: DEV-0537) had a public operational window of December 2021 to September 2022 according to Flare, which assesses the group as defunct. Its model centered on data exfiltration, extortion and destruction without ransomware payloads, relying on insider recruitment, compromised accounts and social engineering. Later attacks should not be attributed to it just because its name or techniques are reused.
- ShinyHunters-branded activity spans cloud and SaaS intrusions. Google separates Salesforce-focused voice phishing (UNC6040) from the later extortion (UNC6240), and its January 2026 research tracks ShinyHunters-branded activity across UNC6661, UNC6671 and UNC6240, reflecting evolving partnerships and possible impersonation.
- Flare argues this structure explains why arrests disrupt individual operators without eliminating the ecosystem. Continued use of a name alone does not demonstrate operational continuity.
Remediation
- Correlate infrastructure, identity telemetry, forensic artifacts and independently supported actor links before naming a group.
- Follow CISA guidance: deploy phishing-resistant MFA, control remote access software and monitor for account misuse.
- Keep observed behavior, assessed cluster membership and criminal branding separate in incident reporting and remediation planning.