ZeroFox Intelligence Flash Report - Scattered Lapsus$ Hunters Announce Temporary Dissolution

ZeroFox Intelligence Flash Report - Scattered Lapsus$ Hunters Announce Temporary Dissolution

Product Serial: F-2025-10-15a

TLP:CLEAR

In this Flash report, ZeroFox researchers report on Scattered Lapsus$ Hunter's second dissolution announcement which was followed by several claims of the collective's intent to increasingly target U.S. government agencies, and launch extortion-as-a-service campaigns.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• Threat collective Scattered Lapsus$ Hunters (SLSH) posted on its Telegram channel on October 11, 2025, that it was ceasing activities until 2026, likely in an effort to reduce law enforcement (LE) scrutiny while retooling and figuring out the group’s next steps.
• SLSH is touting the launch of an EaaS campaign—a growing trend offered by threat collectives—on its Telegram channel. This announcement was posted several hours before the one indicating SLSH was dissolving and is almost certainly indicative of the group's intent to remain a prominent threat collective in the cybercrime landscape throughout 2026 and gain further market share of potential affiliates.
• The announcement to temporarily dissolve is almost certainly due to increased scrutiny by LE elements. It is very likely SLSH will use the pause to review its operational security and seek ways to avoid further LE disruptions.