policy
Alleged ShinyHunters Leader Arrested in Jordan
An individual believed to be the leader of the ShinyHunters extortion group, Saif al-Din Khader (Rey), has been arrested in Jordan and is cooperating with the FBI.
Low
Threat intelligence
- Suspected origin
- Brazil
- First seen
- 2021-01-01 00:00:00
- Motivation
- Financial gain
- TLP
- WHITE
(Flashpoint) LAPSUS$ is an extortionist threat group that became active on December 10, 2921. Unlike the majority of extortionist groups that typically rely on a combination of ransomware and data leaks, LAPSUS$ is focused on monetizing their operations exclusively through data leaks advertised on Telegram without the use of ransomware. Initially, the group focused on data breaches against Latin American and Portuguese targets but in late February 2022, LAPSUS$ began widening the scope of its targeting by announcing it had successfully breached US-based graphics and computing chip manufacturer Nvidia. Since then, LAPSUS$ has continued to focus on large-scale international technology companies, including Microsoft, Okta, and Samsung, as the financial incentive for stealing source code and extorting companies for sensitive proprietary technical data is high. Around July 2025, ShinyHunters teamed up or merged with Subgroup: Scattered Spider. They share their Telegram channel also with Lapsus$, so they may all work together now – see the DataBreaches.net references in the Information section under ShinyHunters.
Also known as
DEV-0537G1004LAPSUS$Slippy SpiderStrawberry Tempest
Tooling and malware
Mimikatz
MITRE ATT&CK techniques
T1005 Data from Local SystemT1090 ProxyT1111 Multi-Factor Authentication InterceptionT1621 Multi-Factor Authentication Request GenerationT1204 User ExecutionT1485 Data DestructionT1489 Service StopT1531 Account Access RemovalT1199 Trusted RelationshipT1133 External Remote ServicesT1068 Exploitation for Privilege EscalationT1589 Gather Victim Identity InformationT1078 Valid Accounts
Coverage 9
ransomware
Academic publisher Elsevier hit by LAPSUS$ redirect attack
Academic publisher Elsevier was briefly compromised by a LAPSUS$ redirect attack, where users were redirected to a cybercriminal leak page. LAPSUS$, known for attacks on companies like Rockstar Games and Adidas, was behi…
High
threat-intel
Revolut handed customer data to fraudsters using government email account
Revolut, a British fintech company with over 80 million customers, disclosed that it handed customer data to fraudsters who used a legitimate government email account to submit fake data requests. The attackers targeted…
High
threat-intel
LAPSUS$ réapparaît autour d’une attaque contre Courir
The LAPSUS$ group, a notorious name in cybercrime, has seemingly resurfaced, attempting to rebuild its operations and recruit insiders. The group, claiming continuity with its past, is now seeking privileged access withi…
High
threat-intel
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
UNC6671, a data extortion group linked to ShinyHunters and potentially SLH, is leveraging sophisticated vishing tactics to steal SaaS data from organizations across multiple sectors. They impersonate IT help desks, direc…
High
threat-intel
Mercor face aux affirmations d’un pirate
A hacker claiming to be linked to Lapsus$ is alleging a major data breach at Mercor, a US startup specializing in AI data and intelligence. The hacker claims to possess 1.150GB of user data, including biometric informati…
High
threat-intel
Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access
A threat actor, linked to the O-UNC-066 group (affiliated with The Com/Scattered Spider), is using a sophisticated, operator-controlled phishing kit to trick users into enrolling fake Microsoft Entra passkeys, gaining un…
High
threat-intel
Out of the Crypt: The Evolving Cyber Extortion Economy
This report from Palo Alto Unit 42 highlights a significant shift in the cyber extortion landscape, moving away from ransomware-based pressure towards pure data theft and extortion. The trend is driven by factors like ad…
High
ransomware
Congress Puts Heat on Instructure After Canvas Outage
Following a high-profile cyberattack on its Canvas learning management system by the ShinyHunters group, Instructure is facing increased scrutiny from Congress. The House Committee on Homeland Security has requested a br…
High
