Flare says Scattered Spider, LAPSUS$ and ShinyHunters are separate clusters
Original title: Scattered Spider, LAPSUS$, and ShinyHunters Operate as Distinct Groups Within The Com Ecosystem
Shared branding does not prove one gang; Flare treats original LAPSUS$ as defunct after September 2022.
Flare argues The Com is a loose, mostly English-speaking cybercriminal subculture, not one organization. Scattered Spider, also tracked as UNC3944, Octo Tempest and Muddled Libra, targets enterprise identity workflows through impersonation, password resets, MFA changes and SIM swapping, then remote management tools and, in Microsoft’s account, DragonForce ransomware. Flare places original LAPSUS$ (DEV-0537) between December 2021 and September 2022 and calls it defunct. Google splits ShinyHunters-branded activity across clusters including UNC6040 and UNC6240.
Unconfirmed: Cluster boundaries and LAPSUS$ being defunct are Flare’s assessment, not independently confirmed here.
- SP1D3R HUNTERS, or SLH, is described as a brand, not a fourth group.
- Scattered Spider aliases cited include UNC3944, Octo Tempest and Muddled Libra.
- Flare dates original LAPSUS$, tracked as DEV-0537, from December 2021 to September 2022.
- Google separates Salesforce voice phishing UNC6040 from extortion tracked as UNC6240.
- CISA advises phishing-resistant MFA and controls on remote access software.
- ATT&CK
- T1656 ImpersonationT1098 Account ManipulationT1621 Multi-Factor Authentication Request GenerationT1219 Remote Access SoftwareT1486 Data Encrypted for Impact
- Malware
- DragonForce
From the original article
2 min read at gbhackers.com
Scattered Spider, LAPSUS$, and ShinyHunters represent distinct intrusion clusters within The Com, not interchangeable names for one cybercriminal organization. The analysis separates these clusters from SP1D3R HUNTERS, also called Scattered LAPSUS$ Hunters (SLH), which it describes as a shared brand and coordination layer rather than a fourth operational group. That distinction has immediate consequences for […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.