ZeroFox Intelligence Flash Report - Prominent Threat Collective Announces Disbandment

ZeroFox Intelligence Flash Report - Prominent Threat Collective Announces Disbandment

Product Serial: F-2025-09-16a

TLP:CLEAR

In this Flash report, ZeroFox researchers discuss the "Scattered Lapsus$ Hunters" threat collective's disbandment announcement and their other recent activity.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• On September 11, 2025, the prominent threat collective “Scattered Lapsus$ Hunters” announced on its public Telegram channel that it was ceasing operations. The message also appeared on the homepage of breachforums[.]hn, with a link to the collective’s Telegram page.
• In the post, Scattered Lapsus$ Hunters explained that it is intentionally disbanding now that its objectives have been fulfilled. The collective emphasized that this decision is not a defeat or reaction to law enforcement (LE) pressure but rather the planned conclusion of a campaign.
• Although Scattered Lapsus$ Hunters claims to have ceased operations, it is likely that its Indicators of Compromise (IOCs) remain relevant for detection and hunting and that credentials and malware associated with the threat collective are still active or may resurface in future incidents.