Flare says Scattered Spider, LAPSUS$ and ShinyHunters are separate clusters
Shared branding does not prove one gang; Flare treats original LAPSUS$ as defunct after September 2022.
48
- Mentions · 7d0
- Mentions · 30d7
- All mentions11
- First seenSep 22, 2026
- Last mentioned9d ago
Timeline
11 articles · newest firstRansomware gets personal: 'We-know-where-you-are kind of stuff'
Semperis survey finds 37% of ransomware cases include psychological or physical threats against staff and families.
66
Hackers Steal Rockstar Source Code, 78.6 Million Records and Playable GTA VI Build
Lares links separate Rockstar intrusions to stolen source code, 78.6 million analytics records, and a leaked GTA VI build.
74
Another ShinyHunters suspect arrested
Authorities arrested a teenage ShinyHunters suspect in Jordan, the second member detained after a Dutch arrest.
74
Rockstar Games Attacks Expose MFA Fatigue, OAuth Token Theft and Dev Pipeline Security Failures
Lares ties Rockstar breaches to MFA fatigue and stolen OAuth tokens, including a claimed 78.6-million-record Snowflake leak.
58
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
Jordan detained ShinyHunters suspect Rey, who is reportedly helping the FBI identify other members.
76
ShinyHunters hacker reportedly detained in Jordan, aiding FBI
Jordan reportedly detained ShinyHunters suspect Saif al-Din Khader, who is helping the FBI find other members.
67
Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.
80
Academic publisher Elsevier hit by LAPSUS$ redirect attack
Elsevier says a short-lived LAPSUS$ compromise redirected some visitors to a criminal leak page.
62
Elsevier Evolve, ClinicalPharmacology, and GSDD APIs Hijacked: LAPSUS$ Redirect Campaign
LAPSUS$ hijacked Elsevier education and clinical APIs, redirecting users to extortion splash pages.
75
Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page
Three Elsevier domains, including manuscript portal submit.elsevier.com, redirected for 78 minutes to a LAPSUS$ extortion page taunting the FBI.
72
Related CVEs
by mentions- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2026-9361692%9.8Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2023-240592%7.3Grand Theft Auto V for PC allows attackers to achieve partial remote code execution or modify files on a PC, as exploited in the wild in January 2023
Appears with
- ShinyHuntersthreat actor · 8
- Scattered Spiderthreat actor · 6
- FBIorganization · 5
- FBIvictim · 3
- Scattered Lapsus$ Huntersthreat actor · 3
- Elseviervictim · 3
- Microsoftorganization · 3
- Elsevierorganization · 3
- Hellcatthreat actor · 2
- Snowflakeproduct · 2
- Laresorganization · 2
- Snowflakevendor · 2
- PeopleSoftproduct · 2
- Confluenceproduct · 2
- Instructurevictim · 2
- Grand Theft Auto VIproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.