Cybercrime Group Scattered Lapsus$ Hunters Shifts Tactics Amid Law Enforcement Pressure

Cybercrime Collective Adapts Operations

The hacking group known as Scattered Lapsus$ Hunters appears to be modifying its operational strategies, according to reports from Palo Alto Networks’ Unit 42 threat intelligence team. Sources indicate the group is developing an extortion-as-a-service (EaaS) program and potentially new ransomware, signaling a tactical pivot observed through monitored Telegram channels since early October 2025.

Cybercrime Collective Adapts Operations
New Extortion-As-A-Service Model
Potential New Ransomware Development
Law Enforcement Pressure Mounts
Data Leak Site Developments
Broader Criminal Network Context

New Extortion-As-A-Service Model

Analysts suggest the EaaS program would operate similarly to ransomware-as-a-service (RaaS) models but without file encryption components. The report states this approach could represent an attempt to “fly under the radar of law enforcement attention” by avoiding traditional ransomware signatures that trigger security alerts. However, researchers noted uncertainty about whether this business model will prove as financially successful as the threat actors anticipate.

Potential New Ransomware Development

Unit 42 also identified Telegram posts discussing and testing new ransomware believed to be dubbed SHINYSP1D3R. These October 4 communications align with earlier observations documented by Falconfeeds in August 2025. While concerning, analysts suggest it remains unclear whether this ransomware is actively under development or represents false claims meant to bolster the group’s reputation.

Law Enforcement Pressure Mounts

The tactical shifts coincide with increased law enforcement actions against cybercrime groups. Recent months have seen UK arrests of Scattered Spider-linked members and two teenagers connected to the Kido cyber-attack. This heightened scrutiny may be driving operational changes as threat actors attempt to maintain effectiveness while avoiding detection., according to additional coverage

Data Leak Site Developments

Researchers attempting to access the group’s data leak site discovered what appeared to be a defacement message, preventing confirmation of whether victim data remained listed. The group had previously set an October 10, 2025 deadline for ransom payments, after which data from at least six companies was leaked. Surprisingly, the threat actors announced on October 11 that “nothing else will be leaked,” suggesting possible additional strategic reassessment.

Broader Criminal Network Context

Scattered Spider, ShinyHunters and LAPSUS$ operate under The Com, a loosely organized criminal network involving thousands of English-speaking individuals. Despite claims in September that they would shut down operations, many analysts viewed this as either a public relations stunt or an attempt to temporarily reduce activity during peak law enforcement attention.

The evolving tactics demonstrate how cybercrime groups continuously adapt to security measures and law enforcement pressure, creating ongoing challenges for cybersecurity professionals and organizations worldwide.