ZeroFox Intelligence Flash Report - Threat Collectives Seemingly Announce Collaboration

ZeroFox Intelligence Flash Report - Threat Collectives Seemingly Announce Collaboration

Product Serial: F-2025-08-13a

TLP:CLEAR

In this Flash report, ZeroFox researchers report on an announcement of an alleged collaboration between the threat collectives Scattered Spider, Lap$us, and ShinyHunters.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• On August 8, 2025, a new account surfaced on instant messaging platform Telegram named “scattered lapsu$ hunters - The Com HQ SCATTERED SP1D3R HUNTERS”. The channel was launched by individuals claiming to be part of the prominent cybercrime collectives Scattered Spider, Lap$us, and ShinyHunters.
• In its brief four-day lifespan, posts on the “scattered lapsu$ hunters - The Com HQ SCATTERED SP1D3R HUNTERS” Telegram channel resembled the types of activity Scattered Spider, ShinyHunters, and Lapsu$ are known for within their own Telegram channels.
• In the new Telegram channel, “Shiny”, alleged that BreachForums is now under the control of a French cybercrime law enforcement (LE) unit, with assistance from the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI).
• Although the majority of the claims remain unverified, there is a roughly even chance that the launch of this new Telegram channel signals an intent by Scattered Spider, ShinyHunters, and Lapsu$ to collaborate in future cybercrime operations.