Threat actor · all actors
scattered lapsus$ huntersMISP-f18a87a4 criminal
aka scattered lapsus$ hunters, Scattered Lapsus Hunters
Last updated: 2026-08-20
0attributed CVEs
6ATT&CK techniques
0.0IDF score (tooling uniqueness)
0exclusive CVEs
—years active
About this actor
Launched in August 2025, the Scattered LAPSUS$ Hunters collective has rapidly established itself as one of the most formidable threats on today’s cybercriminal landscape. This alliance brings together three of the most notorious English-speaking cybercriminal groups: Scattered Spider, LAPSUS$ and ShinyHunters. In just a few months, this organization has multiplied spectacular attacks against leading companies, stealing billions of pieces of data and perfecting the art of digital extortion.
How we know this
- Data origin
- MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
- Techniques
- Curated — 6 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
No activity events recorded.
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
| No attributed CVEs. | |||||
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
AC-2 | 4 / 6 | 67% |
AC-6 | 4 / 6 | 67% |
CA-7 | 4 / 6 | 67% |
CM-5 | 4 / 6 | 67% |
CM-6 | 4 / 6 | 67% |
IA-2 | 4 / 6 | 67% |
IA-5 | 4 / 6 | 67% |
SI-4 | 4 / 6 | 67% |
AC-3 | 3 / 6 | 50% |
AC-5 | 3 / 6 | 50% |
CM-7 | 3 / 6 | 50% |
IA-13 | 3 / 6 | 50% |
SC-28 | 3 / 6 | 50% |
SC-7 | 3 / 6 | 50% |
AC-20 | 2 / 6 | 33% |
Co-occurring actors
None.
Similar actors
Similar TTPs
- UNC6040 0.83
- ShinyHunters 0.71
- BlackBasta 0.17
- Luna Moth 0.17
- C0027 0.14
Same category
- LAPSUS$ 1.00
- Akira 1.00
- INC Ransom 1.00
- Play 1.00
- BlackByte 1.00