{
	"id": "fcb37bcc-6ac0-42c2-ab79-1a9db4c2a722",
	"created_at": "2026-07-28T02:02:41.937216Z",
	"updated_at": "2026-10-20T09:09:51.11487Z",
	"deleted_at": null,
	"sha1_hash": "7adcfbd2c034d8e53fb98beebd1eae28d22984ac",
	"title": "Resecurity | Trinity of Chaos: The LAPSUS$, ShinyHunters, and Scattered Spider Alliance Embarks on Global Cybercrime Spree",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 18700765,
	"plain_text": "https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nResecurity | Trinity of Chaos: The LAPSUS$, ShinyHunters, and\n\nScattered Spider Alliance Embarks on Global Cybercrime Spree\n\nPublished: 2025-09-25 · Archived: 2026-07-28 02:00:45 UTC\n\nIntroduction\n\nLAPSUS$, Scattered Spider, and ShinyHunters are three of the most notorious English-speaking cybercrime\n\ngroups operating today. While each group has its own distinct origins and operational history, recent developments\n\n(especially since 2023 to 2025) reveal significant connections, tactical overlaps, and even direct collaboration.\n\nThese connections are evident in their shared proclivity for social engineering, overlapping membership, joint\n\npublic channels, and coordinated attacks on high-profile targets. The lines between these groups have become\n\nincreasingly blurred, with cybersecurity researchers and law enforcement now viewing them as part of a loosely\n\nconnected and highly adaptive cybercrime ecosystem.\n\nIrrespective of individual attack attribution, these groups have revealed to the world the alarming cyber-insecurity\n\nof major Fortune 100 corporations and government agencies, particularly considering that social engineering-\n\nbased attacks have remained their primary method of gaining access to target networks.\n\nThe attack vectors and exploitation techniques used by the actors were not particularly sophisticated; instead, they\n\nwere well-organized and coordinated, exploiting both human weaknesses and technological misconfigurations.\n\nThese actors rely on social engineering techniques, often impersonating employees or contractors to deceive IT\n\nhelp desks into granting them access.\n\nIn this report, Resecurity has prepared a summary of the activity associated with these actors, based on human\n\nintelligence (HUMINT) and collaboration with incident response teams from the affected victim organizations.\n\nResecurity does not believe that the group's recent announcement of ceasing operations is sincere. On the contrary,\n\nour team has become aware of multiple previously undisclosed victims who are currently being extorted privately.\n\nThe group has likely decided to operate discreetly after establishing substantial credibility and a proven track\n\nrecord of successful hacks and large-scale data breaches. As such, the group can now leverage its commanding\n\nreputation to coerce victim payments without having to immediately engage the media to help amplify its ransom\n\nthreats.\n\nDocumented Connections and Collaboration\n\nA. Joint Operations and Public Collaboration\n\nIn August 2025, a Telegram channel explicitly combined the brands and apparent memberships of Scattered\n\nSpider, LAPSUS$, and ShinyHunters. T\n\nhis channel was used to coordinate threats, tease data leaks, and market a new Ransomware-as-a-Service (RaaS)\n\noffering dubbed “shinysp1d3r.” Security researchers described the channel as \"chaotic,\" and it was eventually\n\nPage 1 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nbanned by Telegram\n\n.\n\nShinyHunters confirmed that Scattered Spider provided initial access to targets, while the former handled data\n\nexfiltration and dumps. LAPSUS$ members were also active participants in this alliance, with all three groups\n\nworking together on high-profile campaigns, such as the Salesforce and Snowflake breaches.\n\nOn September 12, the FBI released a FLASH alert on the targeting of Salesforce platforms by the cybercriminal\n\ngroups UNC6040 and UNC6395, which are responsible for a surge in data theft and extortion attempts. If this\n\nattack method is not entirely new, Resecurity has documented several Fortune 100 companies that received\n\nextortion emails bearing signatures and verified contact details of the ShinyHunters threat group.\n\nDespite the group's “retirement” announcement, it is doubtful that threat actors will stop their operations. Such\n\n'exits' have occurred before, providing hacker collectives time to regroup and reemerge later under different\n\nnames. The notorious Russian ransomware gang Conti is a prime example of this exit cover.\n\nB. Association with \"The Com\" Collective\n\nLAPSUS$\n\n, ShinyHunters, and Scattered Spider are linked to 'The Com,' a predominantly English-speaking cybercriminal\n\necosystem. This loosely organized network operates more as a cybercrime youth movement, encompassing a\n\nbroad and constantly shifting range of actors, mainly teens and 20somethings.\n\nSome of the announcements related to successful data breaches by the actors were published at the associated\n\nTelegram channel known as \"The Comm Leaks\". The amplification of the trio’s malicious campaigns via official\n\nCom channels suggests at least some level of shared ideology, membership, resources, or possible operational\n\ncoordination. The FBI issued a Public Service Announcement (PSA) warning about the risks associated with\n\njoining such movements.\n\nPage 2 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThe Com is a primarily English-speaking, international, online ecosystem comprised of multiple interconnected\n\nnetworks whose members, many of whom are minors, engage in a variety of cyber-enabled crimes. Members of\n\nHacker Com typically have a shared interest, ideology, or goal and work together, adding others to the group and\n\nsplintering when necessary to achieve their objectives.\n\nIn fact, there are several groups associated with \"The Com\" movement. Some of them are advertised via \"Com\n\nAdvertising\" and \"Combosses\" channels. They are indirectly linked to key actors responsible for network\n\nintrusions and hacking activities, thereby promoting the ideology in general.\n\n2. Overlaps in Tactics, Techniques, and Procedures (TTPs)\n\nA. Social Engineering and Phishing\n\nAll three groups are renowned for their advanced social engineering capabilities, including vishing (voice\n\nphishing), phishing, and impersonation of IT staff to trick employees into granting them access or installing\n\nmalware. Both LAPSUS$ and Scattered Spider are known for help desk impersonation and credential theft,\n\nwhile ShinyHunters has recently adopted similar vishing tactics, especially in attacks on Salesforce\n\nenvironments.\n\nB. MFA Bypass and SIM Swapping\n\nL\n\nAPSUS$ pioneered the use of SIM swapping and MFA bombing (push fatigue) to bypass multi-factor\n\nauthentication (MFA), techniques now widely used by Scattered Spider and, to a lesser extent, ShinyHunters\n\n.\n\nC. Data Theft, Extortion, and Publicity\n\nA\n\nll three groups focus on stealing large volumes of data and extorting victims by threatening to leak it. Their\n\nextortion tactics often involve public shaming, leak sites, and direct communication with victims\n\n.\n\nPage 3 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nT\n\nhe collective has recently gamified data leaks, using public polls to decide which victim's data to release next,\n\nmaximizing psychological impact and publicity\n\n.\n\nD. Target Selection and Attack Vectors\n\nThe groups have jointly targeted organizations in the financial services, technology, retail, and airline sectors,\n\nincluding Qantas, Allianz Life, LVMH, Adidas, Google, and more.\n\nTheir campaigns are characterized by rapid adaptation and creative use of cloud service vulnerabilities, especially\n\nin VMware hypervisor environments like VMware ESXi and SaaS platforms like Salesforce and Snowflake.\n\n3. Overlaps in Membership and Ecosystem Fluidity\n\nThe level of coordination and blending of tactics among the three groups strongly suggests at least some\n\noperational overlap or shared resources. Security researchers have described the alliance as a \"cybercrime\n\nsupergroup,\" indicating a possible pooling of talent and infrastructure.\n\nThe cybercrime ecosystem is increasingly fluid, with tactics, tools, and even members moving between groups,\n\nmaking attribution and group boundaries less distinct.\n\n4. Recent Developments (2023–2025)\n\nThe partnership between Scattered Spider and ShinyHunters was first teased in the Fall of 2024, but has become\n\nespecially prominent in 2025, with a marked increase in the scale and impact of their attacks. Recently, these\n\nattacks include coordinated phishing and extortion campaigns targeting Salesforce and major global brands.\n\nWhile the groups’ joint branding and shared Telegram channels first surfaced a year ago, their high-profile\n\nreemergence in 2025 show signs of significant escalation, indicating that these groups are not only aware of each\n\nother but are likely actively collaborating or at least coordinating their public-facing activities.\n\nSecurity advisories in 2025 have highlighted the convergence of tactics among these groups, warning that the lines\n\nbetween data theft, extortion, and ransomware are increasingly blurred.\n\nCyberattacks on Airlines\n\nAirlines are frequently targeted by cyberattacks, resulting in operational disruptions, flight cancellations, data\n\nbreaches, and financial losses. Recent incidents include Scattered Spider's ransomware attacks on major global\n\ncarriers like WestJet, Hawaiian, and Qantas in mid-2025, the 2024 Port of Seattle attack impacting airport\n\nservices, and a 2024 Russia-focused attack on Aeroflot by pro-Ukraine hackers. These attacks exploit\n\nvulnerabilities in aging IT systems and aim to steal passenger data or disrupt operations.\n\nIn July 2025, the cybercrime group ShinyHunters claimed responsibility for a data breach at Qantas that\n\ncompromised the personal information of nearly 6 million customers. The attack was part of a larger campaign\n\nPage 4 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\ntargeting Salesforce users through voice-phishing, or \"vishing,\" to steal data for extortion. The breach involved a\n\nthird-party customer service platform used by a Qantas call center.\n\nExample of extortion email received by Qantas:\n\nTypical of ransomware tactics, the actors shared a substantial dump of stolen records as proof of a successful data\n\nbreach. At that time, the company did not disclose the receipt of an extortion email transparently and only\n\nannounced the data breach after a significant delay.\n\nPage 5 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThese groups also collaborate with other cybercrime actors, including initial access brokers (IABs). For example,\n\nin one of the posts shared by the hacking collective, they mentioned a member outside of their community\n\noffering access to an EU-based airline on the Dark Web.\n\nA concerning note: Resecurity has observed similar access postings listed for nearly every airline and airport\n\nauthority around the world. These accounts make these organizations vulnerable to similar attacks at the date and\n\ntime of the attacker’s choosing. Threat actors may combine a variety of methods to acquire compromised data, as\n\nwell as access credentials for further development toward a complete data breach - potentially requiring the\n\nacquisition of infostealer logs, VPN access, and exposed tokens (non-human identities) available for sale on\n\nunderground marketplaces.\n\nPage 6 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nHawaiian Airlines and Canada’s WestJet confirmed that they were still assessing the fallout from recent\n\ncyberattacks, though the airlines did not name the perpetrators. WestJet said in a June 18 statement that it has\n\nmade significant progress in safeguarding its digital environment and supporting the specialized teams working to\n\nresolve the cyber incident that began on June 13, 2025. “As soon as a cybersecurity incident was identified, we\n\ntook immediate action, including but not limited to launching an investigation, engaging world-class third-party\n\ncyber security experts and forensic specialists, and notifying our people and guests of our ongoing efforts.”\n\nHawaiian Airlines said in its latest cybersecurity update on June 26 that it “is continuing to address a cybersecurity\n\nevent that has affected some of our IT systems. We continue to operate our full flight schedule safely, and guest\n\ntravel is not impacted. As we navigate the ongoing event, we remain in contact with the appropriate experts and\n\nfederal authorities. We will provide updates as more information is available.” More victims in the aviation\n\nindustry could come forward, sources briefed on the investigation said.\n\nCyberattacks on Retailers\n\nStarting in April, a campaign linked to Scattered Spider threat actors and the DragonForce ransomware gang has\n\nalso targeted multiple retailers across the United Kingdom, including Marks \u0026 Spencer, Co-op, and Harrods.\n\nVictoria's Secret experienced a significant security incident in late May 2025, forcing the company to take its U.S.\n\ne-commerce site offline for several days. The incident also disrupted corporate systems, leading to a postponement\n\nof the company's first-quarter earnings report. While the full scope of the breach is still under investigation by\n\nthird-party experts, and the company has not confirmed if customer data was compromised, the disruption is\n\nexpected to impact the company's second-quarter operating income by an estimated $10 million.\n\nPage 7 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThis security incident follows a series of attacks targeting other fashion companies in recent weeks, including\n\nFrench luxury fashion brands Cartier and Dior. German sportswear giant Adidas was also breached last month,\n\nwith the threat actors stealing some of its customers' data after hacking into a customer service provider’s system.\n\nResecurity acquired artifacts confirming unauthorized access shared via Telegram channel\n\n(\"sctt3rd\"), demonstrating an internal dashboard of the retailer.\n\nCyberattacks on Telecoms\n\nBack in 2021, ShinyHunters claimed to have breached AT\u0026T and put the alleged stolen data up for sale for $1\n\nmillion. Fast forward three years, and another threat actor, calling themselves MajorNelson, leaked what they said\n\nwas the same data. However, AT\u0026T denies (both in 2021 and in 2024) that the data came from its systems, telling\n\nBleepingComputer that it saw no evidence of a breach.\n\nPage 8 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nHowever, in March 2024, AT\u0026T confirmed that data leaked from the 2021 breach they previously denied was\n\nindeed theirs, acknowledging that it affected approximately 73 million current and former customers. This\n\nadmission marked a significant reversal from the company’s initial position.\n\nA separate cyberattack transpired in April 2024 after hackers John Eric Binns and Connor “Judische” Moucka\n\nallegedly exploited security flaws in Snowflake, a cloud data warehouse provider. This supply-chain attack\n\naffected over 165 organizations, with AT\u0026T among the victims. The Snowflake-related breach exposed call and\n\ntext metadata for nearly 110 million AT\u0026T customers between May 1, 2022, and October 31, 2022, along with\n\nsome records from January 2, 2023. Notably, this breach involved call logs and interaction data but did not contain\n\npersonally identifiable information (PII) like Social Security Numbers (SSNs).\n\nReports indicate that AT\u0026T paid Binns and Moucka a ransom of approximately $370,000 in Bitcoin to have the\n\nSnowflake-related stolen data deleted. Moucka, also known as ‘Waifu’ and ‘scarlet the meow cat,’ also\n\nfrequently posted in a since-deleted Telegram channel that was active in the Fall of 2024 called\n\n“lapsus$hiny$catteredwizard$pider.\"\n\nPage 9 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nPage 10 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nAs the name of the channel suggests, the collaboration between the three eponymous groups likely commenced\n\nnearly a year before their more recent chaos-themed channel captured the attention of the cyber-threat-intelligence\n\n(CTI) community. Additionally, Moucka’s highly active participation in this channel indicates some level of\n\nconnectivity and possible collaboration between the since arrested Snowflake hacker and these threat groups. To\n\nthis point, the ShinyHunters group was also associated with this Snowflake campaign, having taken credit for the\n\nmajor Ticketmaster data breach connected to the same security incident.\n\nSome time ago, the hacking trio mentioned AT\u0026T again and released a screenshot purportedly showing access to\n\nthe RSA Token / VPN Management dashboard. The actors sanitized the access details, which makes it impossible\n\nto verify this information independently. However, the fact that they are mentioning the same target again may\n\nindicate continued interest in the telecom sector overall.\n\nThe group also mentioned T-Mobile and released a potential access to the JFrog Platform. In fact, this is not the\n\nfirst time advanced cybercriminals have targeted T-Mobile and have become victims of a cyber-attack.\n\nT-Mobile has been targeted by multiple hacking groups and individuals over the years, with several high-profile\n\nbreaches. In the summer of 2021, T-Mobile confirmed a massive data breach that exposed millions of customer\n\nPage 11 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nrecords. The hacker who took credit for this breach was Moucka’s AT\u0026T collaborator Binns, who was also\n\narrested in Turkey in 2024.\n\nBinns publicly claimed responsibility for the attack, which led to significant regulatory scrutiny and a $15 million\n\nfine for T-Mobile in 2024. Notably, the hacking conglomerate mentioned Binns in one of their recent Telegram\n\nupdates.\n\nResecurity has been tracking Binn's activity since August 2021, when he and his associates created the\n\nintelsecrets[.]su websites to harass U.S. government officials and publicize stolen data. Binn and his associates\n\nwere using several aliases, including but not limited to \"irdev007,\" \"und0xxed,\" \"v0rtex,\" \"IlIIIIIIIIIIlI\", \"Antonio\n\nSantisteban\", \"Aslan Aliev,\" and \"Anton Lyshevskiy,\" falsely claiming to be originally from Minsk, Belarus.\n\nOn some of his profiles, Binn also falsely claimed to be from Russia and even created several accounts on\n\nRussian-speaking Dark Web forums and email providers. One such account has been identified by Resecurity,\n\nalong with his personal cellphone number registered via a foreign mobile carrier. Possibly, the actor thought that\n\nsuch measures could improve his OPSEC and complicate further investigation.\n\nPage 12 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nIn one of the email messages acquired by Resecurity's HUNTER (HUMINT) team, the actor attempted to contact\n\nthe now-deceased John McAfee and accused law enforcement of wrongdoing against him. He also mentioned\n\nseveral FBI employees and IC members at the intelsecrets[.]su website, threatening them.\n\nThe actor attempted to monetize stolen T-Mobile data for $150,000, to be paid in cryptocurrency. Notably, he\n\nagreed to use escrow via RaidForums and provided numerous samples confirming the breach.\n\nPage 13 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThe actor also shared a screenshot from a possibly compromised system, showing a successful login dated\n\nSeptember 29, 2015, via SSH. According to him, this access was obtained to penetrate the T-Mobile network.\n\nPage 14 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThe actor shared various internal identifiers, hostnames, and references. He also indicated that the system could be\n\nused by one of the FBI units for lawful interception purposes, and such access would provide extremely extensive\n\nvisibility into the activities of mobile carrier customers.\n\nPage 15 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nResecurity acquired data samples containing consumer details, along with IMSI and other fields, stored in Elastic\n\ndata lake.\n\nPage 16 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nBinn's activity demonstrated some of the first episodes in cybercrime history of targeted attacks against law\n\nenforcement and telecommunications companies, and it is likely that the collective has continued to conduct these\n\nattacks at a much more sophisticated level. For example, one year later, other groups like Lapsus$ also claimed\n\nresponsibility for breaching T-Mobile's internal systems.\n\nThe actors also mentioned Bouygues Telecom, the third oldest mobile network operator in France, after Orange\n\nand SFR, as one of the targeted telecoms. At the beginning of August, Bouygues Telecom, a large French mobile\n\ncarrier, disclosed a cyberattack and data breach affecting more than 6 million customer accounts. At that time, no\n\nspecific threat actor or group was identified.\n\nPage 17 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nAt the same time, the data presumably stolen from Bouygues Telecom began to appear on the Dark Web for sale.\n\nResecurity has acquired a substantial number of records from several different actors, confirming the involvement\n\nof access brokers during the early stages of the intrusion. As of today, a group calling themselves \"J Ransomware\"\n\nclaimed responsibility for the attack and shared the stolen data in the form of a Torrent file available for download\n\nvia their Data Leak Site (DLS) on the TOR network.\n\nPage 18 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThese details may suggest a possible overlap between the activities of the hacking \"trio,\" independent access\n\nbrokers, and ransomware groups. Given that the cybercrime ecosystem is highly dynamic, actors may collaborate,\n\nexchange, share, and reuse stolen data and access among themselves to identify the most effective monetization\n\nstrategies.\n\nCyberattacks on Law Enforcement\n\nNeither ShinyHunters nor Scattered Spider has a documented history of directly attacking law enforcement\n\nagencies. Contrarily, some new content has started to emerge, although the details remain limited due to the\n\npotential sensitivity of such activities, and that the trio’s recent breach claims are false. Before the group\n\ndisappeared from public channels, the hacking trio claimed to have breached various law enforcement agencies,\n\nincluding the FBI. In their postings, they published data samples and screenshots suggesting a possible\n\ncompromise of an account within an undisclosed law enforcement system.\n\nThe actor with the alias UNC6395 shared several text files containing identifiers of various applications and\n\nhostnames referencing the U.S. government.\n\nPage 19 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nIt is possible that the group attempted to demonstrate resilience after legal actions were taken against one of their\n\nmembers by French and U.S. law enforcement authorities.\n\nThe actors also shared screenshots from the so-called NICS E-Check system (National Instant Criminal\n\nBackground Check System). Law enforcement and criminal justice agencies use this system to conduct\n\nbackground checks.\n\nPage 20 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nPage 21 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nSimilar messages have been directed by the trio toward Italian law enforcement. The actors leaked a possible\n\nreport, presumably authored by the police, related to their activities. Resecurity’s dark web data collection has\n\nidentified users accessing the NICS system from devices controlled by threat actors, including accessing systems\n\nfrom infected devices outside the United States.\n\nIn the trio’s last posts before their farewell announcement, the group also claimed to have breached sensitive law\n\nenforcement data-sharing portals belonging to the UK’s National Crime Agency, responsible for a string of\n\nsuccessful arrests targeting Scattered Spider members, and Google.\n\nThe trio also shared a screenshot from the Law Enforcement Notification System (LENS). This web-based system\n\nprovides local law enforcement with information on federal offenders currently under supervision by the U.S.\n\nCourts. As with the NICS system mentioned above, Resecurity’s dark web data collection has found users\n\naccessing the LENS system from devices under threat actor control, including from infected devices outside the\n\nUnited States.\n\nPage 22 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nCyberattacks on Salesforce\n\nMost recently, ShinyHunters and their collaborators have made headlines for actively targeted Salesforce\n\nenvironments in a series of high-profile cyberattacks throughout 2025. These attacks involved sophisticated social\n\nengineering, vishing, and OAuth token abuse to compromise Salesforce accounts and exfiltrate large volumes of\n\ndata from numerous blue chip companies.\n\nThe group exploited OAuth tokens to access Salesforce environments, enabling them to steal massive amounts of\n\ndata from hundreds of organizations. ShinyHunters claimed to have stolen over 1.5 billion Salesforce records\n\nfrom 760 companies by compromising OAuth tokens associated with Salesloft and Drift integrations. This\n\nallowed the group to access and exfiltrate customer relationship management (CRM) data at scale.\n\nPage 23 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThe actors shared multiple dumps and outputs demonstrating the exploitation of vulnerable instances belonging to\n\nmajor Fortune 100 companies worldwide. Notably, the complete data has not been publicly released; only\n\nfragments and screenshots have been shared as proof. The actors are concealing the full extent of the compromise,\n\nwhich involves a massive volume of stolen data.\n\nExample of a compromised Salesforce instance:\n\nPage 24 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThe issue affected over 20 companies, including cybersecurity vendors:\n\nAttack on Jaguar Land Rover (JLR)\n\nJaguar Land Rover (JLR) has been the target of several significant cyberattacks in 2025. The most recent attack\n\ndiscovered on August 31— a breach of historically catastrophic proportions— has been credibly attributed to the\n\nthreat actor trio of Scattered Spider (also known as Octo Tempest/UNC3944), ShinyHunters, and Lapsus$.\n\nPage 25 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThere is no indication this breach, which has shut down JLR’s global production line for over the last three weeks\n\nand threatens a major auto industry supply-chain disaster, is linked to the broader Salesforce campaign. In fact,\n\nintelligence collected by Resecurity suggests this attack is part of a unique exploit campaign that has no links to\n\nthe Salesforce supply-chain saga.\n\nNotably, a separate earlier breach in March 2025 was attributed to the HELLCAT ransomware group, which\n\ncounts an actor known as \"Rey\" from Raidforums as a leading member. Rey, reportedly relied on infostealer\n\nharvesting to steal Jira credentials from an LG Electronics employee (siphoned by Lumma malware). Jira is a\n\nwidely used software development collaboration tool that helps engineers manage projects and track issues.\n\nInfostealers are a type of malware designed to harvest sensitive information from infected devices covertly. This\n\nincludes login credentials, session cookies, browser-stored passwords, and other authentication data. Once\n\nexfiltrated, this information is sold on cybercrime marketplaces or used directly by attackers to access high-value\n\nplatforms like Salesforce. Ordinary infostealer families used in enterprise attacks include Azorult, Lumma,\n\nRedLine, Raccoon, and Vidar.\n\nInfostealers harvest not only usernames and passwords, but also active session cookies. Attackers use these to\n\nhijack authenticated sessions, gaining immediate access to Salesforce without triggering login alerts or MFA\n\nchallenges. Attackers also trick users into authorizing malicious “Connected Apps” in Salesforce, which can\n\ngenerate long-lived OAuth tokens. These tokens grant persistent access to Salesforce data, often bypassing MFA\n\nand other controls.\n\nPage 26 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nDarkforums administrator Knox amplified the same breach at roughly the same time as Rey:\n\nRey exfiltrated gigabytes of data from JLR, including Jira issues, source code, employee databases, usernames,\n\nemails, and dev logs, which were then leaked on forums to facilitate phishing and lateral attacks. Notably, an\n\naccount with the same alias was present in the member list of the chaos-themed Telegram channel created by the\n\nhacking trio. However, there is no conclusive evidence these personas belong to the same actor. Shortly after\n\nRey’s March 2025 posting, hacker \"APTS\" dumped 350GB more using 2021 creds.\n\nPage 27 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThere is no evidence that Rey, Knox, APTS, or the broader HELLCAT collective were involved in the more\n\nrecent and disastrous September attack. JLR has confirmed the September 2025 cyberattack, stating it caused\n\nsevere operational disruption and resulted in confirmed data theft.\n\nNotably, right before this string of JLR-related leaks, Rey published data from an unnamed government system,\n\npresumably related to Florida.\n\nCircling back to JLR, Wired reported that the automaker may be “losing up to £50 million ($67 million) per week\n\nin the shutdown.” Additionally, Wired said that, as the production shutdown stretches out until at least the\n\nbeginning of October, “the knock-on impacts are being felt at the hundreds of companies that supply JLR with\n\nparts and materials and risk turning the attack into a full-blown crisis.”\n\nWhile JLR has not publicly named the threat actors, the claims and evidence from Scattered Spider,\n\nShinyHunters, and their collaborators are widely accepted by the cybersecurity community and media as\n\ncredible. This attack caused severe operational disruption and a confirmed data breach.\n\nThe actors shared several samples of stolen data without providing exact timestamps or sources. As suggested by\n\nindependent cybersecurity experts, the data could be stolen at a different time and reused as a result of the\n\nPage 28 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nprevious successful breach.\n\nThe ransomware attack on JLR further highlights the risks associated with IT/OT convergence in the automotive\n\nsector and across the broader manufacturing industry. “While it is unclear which specific JLR systems have been\n\nimpacted by the hackers and what systems JLR took offline proactively, many were likely taken offline to stop the\n\nattack from getting worse,” according to Wired.\n\nAs of September 1, 2025, systems across JLR’s global production centers were offline, disrupting assembly,\n\nlogistics, retail operations, and supplier contracts. This has left completed cars undelivered. In JLR's latest cyber-\n\nincident update, dated September 23, they said the production shutdown will persist until October 1 at the earliest.\n\nNew Forum - New Breach\n\nIn late August 2025, a new underground forum called \"Breachsta.rs\" emerged on the Dark Web.\n\nPage 29 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nA registered account named \"ShinyHunters\" was identified there. However, it remains uncertain whether this\n\naccount belongs to the actual threat actors or if someone is reusing their \"brand.\" In one of the latest posts, threat\n\nactors claimed to have exfiltrated over 160 million records from the National Credit Information Center (CIC) of\n\nVietnam. Resecurity covered these events in a separate threat intelligence report. This is a staggering number,\n\nconsidering Vietnam’s population is under 102 million, which suggests that the dataset includes historical records\n\nand possibly multiple entries per individual.\n\nPage 30 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nNotably, other actors on the forum are offering stolen access credentials to Salesforce, which will serve as one of\n\nthe main catalysts for further successful cyberattacks.\n\nTime to Say Goodbye?\n\nLaw enforcement and cybersecurity agencies have begun to mention LAPSUS$, ShinyHunters, and Scattered\n\nSpider together in briefings and advisories, reflecting the growing perception of overlap and possible joint\n\noperations among these groups. The groups’ ability to rapidly adapt and escalate their attacks has made them a top\n\nconcern for both private sector security teams and law enforcement. The boundaries between LAPSUS$,\n\nScattered Spider, and ShinyHunters have become increasingly fluid, with evidence of both operational overlap\n\nand tactical convergence. These groups now represent a loosely connected, highly adaptive cybercrime ecosystem,\n\nposing an advanced persistent threat (APT) to large enterprises worldwide.\n\nAccording to recent reports, the trio announced that they were retiring and ceasing their activities. The groups\n\nstated they had \"achieved their goals of exposing weaknesses in digital security\". Already, these claims have\n\nproven to be nothing more than performative trolling. On September 18, just days after the gang posted their\n\nretirement announcement, a RAMP forum account credibly believed to be operated by the ShinyHunters leader\n\nclaimed credit for a new campaign targeting the financial services sector in the forum chat.\n\nPage 31 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nResecurity believes that these groups will continue their malicious activities using different names or reorganize\n\nlike Conti rather than truly disbanding. Additionally, the groups themselves hinted that future data breach\n\ndisclosures involving their names do not necessarily mean they are still active, suggesting some ambiguity in their\n\nretirement.\n\nThe text of the \"goodbye letter\" was published on breachforums[.]hn, a domain registered by the actors a few days\n\nbefore the announcement:\n\nThis is also the first time the hacking \"trio\" has mentioned the specific team members involved in their activities:\n\nPage 32 of 33\n\nhttps://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree\n\nThe cached copy of their announcement is available via Wayback Machine.\n\nSignificance\n\nIn closing, Resecurity has identified new, previously undisclosed attacks carried out by this Trinity of Chaos,\n\nalong with reports of new victims receiving extortion emails. This development underscores the urgent need to\n\naccelerate defensive measures and improve employee awareness of such threat actors and their TTPs.\n\nWhile there is a concern about other actors impersonating the group to carry out malicious activities, the new\n\nattributable operations still pose a significant threat to organizations worldwide. Prompt action and heightened\n\nvigilance are essential to mitigate potential damages from these emerging threats.\n\nReferences\n\nThis report would not be possible without the hard work of many cybersecurity industry professionals. In this\n\nsection, Resecurity shares a list of publications providing additional insights into the malicious cyber activities\n\nconducted by these groups.\n\n- Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and\n\nExtortion\n\nhttps://www.ic3.gov/CSA/2025/250912.pdf\n\n- Scattered Spider - Cybersecurity Advisory\n\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a\n\n- Jaguar Land Rover Breached by HELLCAT Ransomware Group Using Its Infostealer Playbook—Then a Second\n\nHacker Strikes\n\nhttps://www.infostealers.com/article/jaguar-land-rover-breached-by-hellcat-ransomware-using-its-info...\n\n- Jaguar Land Rover admits hackers may have taken data\n\nhttps://www.bbc.com/news/articles/cp8wk7rdz8yo\n\n- Cyber Monitoring Centre Statement on Ransomware Incidents in the Retail Sector\n\nhttps://cybermonitoringcentre.com/2025/06/20/cyber-monitoring-centre-statement-on-ransomware-inciden...\n\nSource: https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybe\nrcrime-spree\n\nPage 33 of 33\n\nBinns publicly claimed responsibility for the attack, which led to significant  regulatory scrutiny and a $15 million\nfine for T-Mobile in 2024. Notably , the hacking conglomerate mentioned Binns in one of their recent T elegram\nupdates.           \n\n- Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and\nExtortion \nhttps://www .ic3.gov/CSA/2025/250912.pdf\n\n- Jaguar Land Rover Breached by HELLCA T Ransomware Group Using Its Infostealer Playbook—Then a Second\nHacker Strikes\nhttps://www .infostealers.com/article/jaguar-land-rover-breached-by-hellcat-ransomware-using-its-info...",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree"
	],
	"report_names": [
		"trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree"
	],
	"threat_actors": [
		{
			"id": "9ddc7baf-2ea7-4294-af2c-5fce1021e8e8",
			"created_at": "2023-06-23T02:04:34.386651Z",
			"updated_at": "2026-10-20T02:00:14.358133Z",
			"deleted_at": null,
			"main_name": "Muddled Libra",
			"aliases": [
				"0ktapus",
				"Scatter Swine",
				"Scattered Spider"
			],
			"source_name": "ETDA:Muddled Libra",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c071c8cd-f854-4bad-b28f-0c59346ec348",
			"created_at": "2023-11-08T02:00:07.132524Z",
			"updated_at": "2026-10-20T02:00:17.093116Z",
			"deleted_at": null,
			"main_name": "ShinyHunters",
			"aliases": [],
			"source_name": "MISPGALAXY:ShinyHunters",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "7da6012f-680b-48fb-80c4-1b8cf82efb9c",
			"created_at": "2023-11-01T02:01:06.643737Z",
			"updated_at": "2026-10-20T02:00:07.544497Z",
			"deleted_at": null,
			"main_name": "Scattered Spider",
			"aliases": [
				"Scattered Spider",
				"Roasted 0ktapus",
				"Octo Tempest",
				"Storm-0875",
				"UNC3944"
			],
			"source_name": "MITRE:Scattered Spider",
			"tools": [
				"WarzoneRAT",
				"Rclone",
				"LaZagne",
				"Mimikatz",
				"Vidar",
				"Raccoon Stealer",
				"ngrok",
				"BlackCat",
				"ConnectWise"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6608b798-f92b-42af-a93f-d72800eeb3a3",
			"created_at": "2023-11-30T02:00:07.292Z",
			"updated_at": "2026-10-20T02:00:18.063579Z",
			"deleted_at": null,
			"main_name": "DragonForce",
			"aliases": [],
			"source_name": "MISPGALAXY:DragonForce",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c3b908de-3dd1-4e5d-ba24-5af8217371f0",
			"created_at": "2023-10-03T02:00:08.510742Z",
			"updated_at": "2026-10-20T02:00:16.449619Z",
			"deleted_at": null,
			"main_name": "Scattered Spider",
			"aliases": [
				"0ktapus",
				"DEV-0971",
				"Muddled Libra",
				"Octo Tempest",
				"Storm-0971",
				"Starfraud",
				"UNC3944",
				"Oktapus",
				"Scattered Swine",
				"Scatter Swine"
			],
			"source_name": "MISPGALAXY:Scattered Spider",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "2347282d-6b88-4fbe-b816-16b156c285ac",
			"created_at": "2024-06-19T02:03:08.099397Z",
			"updated_at": "2026-10-20T02:00:04.892176Z",
			"deleted_at": null,
			"main_name": "GOLD RAINFOREST",
			"aliases": [
				"Lapsus$",
				"Slippy Spider ",
				"Strawberry Tempest "
			],
			"source_name": "Secureworks:GOLD RAINFOREST",
			"tools": [
				"Mimikatz"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "52d5d8b3-ab13-4fc4-8d5f-068f788e4f2b",
			"created_at": "2022-10-25T16:07:24.503878Z",
			"updated_at": "2026-10-20T02:00:18.505384Z",
			"deleted_at": null,
			"main_name": "Lapsus$",
			"aliases": [
				"DEV-0537",
				"G1004",
				"Slippy Spider",
				"Strawberry Tempest"
			],
			"source_name": "ETDA:Lapsus$",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "cba0cf55-9830-498e-92b6-a38f663493d3",
			"created_at": "2026-09-17T02:00:03.836127Z",
			"updated_at": "2026-10-20T02:00:05.145052Z",
			"deleted_at": null,
			"main_name": "GOLD PUMPKIN",
			"aliases": [
				"HellCat"
			],
			"source_name": "Secureworks:GOLD PUMPKIN",
			"tools": [],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "3dc5c621-60d5-4799-b280-28640f9da36e",
			"created_at": "2026-09-17T02:00:03.847714Z",
			"updated_at": "2026-10-20T02:00:10.084872Z",
			"deleted_at": null,
			"main_name": "GOLD CRYSTAL",
			"aliases": [
				"Scattered LAPSUS$ Hunters",
				"ShinyCorp",
				"ShinyHunters",
				"UNC6240 "
			],
			"source_name": "Secureworks:GOLD CRYSTAL",
			"tools": [],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "e424a2db-0f5a-4ee5-96d2-5ab16f1f3824",
			"created_at": "2024-06-19T02:03:08.062614Z",
			"updated_at": "2026-10-20T02:00:10.535181Z",
			"deleted_at": null,
			"main_name": "GOLD HARVEST",
			"aliases": [
				"Octo Tempest ",
				"Roasted 0ktapus ",
				"Scatter Swine ",
				"Scattered Spider ",
				"UNC3944 "
			],
			"source_name": "Secureworks:GOLD HARVEST",
			"tools": [
				"AnyDesk",
				"ConnectWise Control",
				"Logmein"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "b7e5c0a1-f8bb-45c8-89b5-b1f1c6fb210d",
			"created_at": "2026-09-17T02:00:03.830668Z",
			"updated_at": "2026-10-20T02:00:04.674935Z",
			"deleted_at": null,
			"main_name": "GOLD FLAME",
			"aliases": [
				"DragonForce"
			],
			"source_name": "Secureworks:GOLD FLAME",
			"tools": [
				"ADFind",
				"AnyDesk",
				"Cobalt Strike",
				"FileSeek",
				"Mimikatz",
				"SoftPerfect Network Scanner",
				"SystemBC",
				"socks.exe"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "009750b9-c282-49ea-a734-cfdc8e05548c",
			"created_at": "2025-09-06T02:00:03.716038Z",
			"updated_at": "2026-10-20T02:00:21.968015Z",
			"deleted_at": null,
			"main_name": "UNC6395",
			"aliases": [],
			"source_name": "MISPGALAXY:UNC6395",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "70929bd1-2bf9-4689-bfff-2bc6b113d3ed",
			"created_at": "2026-01-20T02:00:03.666874Z",
			"updated_at": "2026-10-20T02:00:22.22832Z",
			"deleted_at": null,
			"main_name": "UNC6040",
			"aliases": [],
			"source_name": "MISPGALAXY:UNC6040",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d8dff631-87b0-4320-8352-becff28dbcf1",
			"created_at": "2022-10-25T16:07:24.565038Z",
			"updated_at": "2026-10-20T02:00:18.794628Z",
			"deleted_at": null,
			"main_name": "ShinyHunters",
			"aliases": [],
			"source_name": "ETDA:ShinyHunters",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "49655b30-1cde-4bd4-ae37-ea25ba920a4c",
			"created_at": "2026-08-06T02:00:04.122257Z",
			"updated_at": "2026-10-20T02:00:12.50357Z",
			"deleted_at": null,
			"main_name": "ShinyHunters",
			"aliases": [
				"ShinyHunters",
				"UNC6240",
				"Bling Libra"
			],
			"source_name": "MITRE:ShinyHunters",
			"tools": null,
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "d4b9608d-af69-43bc-a08a-38167ac6306a",
			"created_at": "2023-01-06T13:46:39.335061Z",
			"updated_at": "2026-10-20T02:00:15.050446Z",
			"deleted_at": null,
			"main_name": "LAPSUS",
			"aliases": [
				"DEV-0537",
				"SLIPPY SPIDER",
				"Strawberry Tempest",
				"UNC3661",
				"Lapsus",
				"LAPSUS$"
			],
			"source_name": "MISPGALAXY:LAPSUS",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d093e8d9-b093-47b8-a988-2a5cbf3ccec9",
			"created_at": "2023-10-14T02:03:13.99057Z",
			"updated_at": "2026-10-20T02:00:07.619821Z",
			"deleted_at": null,
			"main_name": "Scattered Spider",
			"aliases": [
				"0ktapus",
				"LUCR-3",
				"Muddled Libra",
				"Octo Tempest",
				"Scatter Swine",
				"Scattered Spider",
				"Star Fraud",
				"Storm-0875",
				"UNC3944"
			],
			"source_name": "ETDA:Scattered Spider",
			"tools": [
				"ADRecon",
				"AnyDesk",
				"ConnectWise",
				"DCSync",
				"FiveTran",
				"FleetDeck",
				"Govmomi",
				"Hekatomb",
				"Impacket",
				"LOLBAS",
				"LOLBins",
				"LaZagne",
				"Living off the Land",
				"Lumma Stealer",
				"LummaC2",
				"Mimikatz",
				"Ngrok",
				"PingCastle",
				"ProcDump",
				"PsExec",
				"Pulseway",
				"Pure Storage FlashArray",
				"Pure Storage FlashArray PowerShell SDK",
				"RedLine Stealer",
				"Rsocx",
				"RustDesk",
				"ScreenConnect",
				"SharpHound",
				"Socat",
				"Spidey Bot",
				"Splashtop",
				"Stealc",
				"TacticalRMM",
				"Tailscale",
				"TightVNC",
				"VIDAR",
				"Vidar Stealer",
				"WinRAR",
				"WsTunnel",
				"gosecretsdump"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "be5097b2-a70f-490f-8c06-250773692fae",
			"created_at": "2022-10-27T08:27:13.22631Z",
			"updated_at": "2026-10-20T02:00:11.141049Z",
			"deleted_at": null,
			"main_name": "LAPSUS$",
			"aliases": [
				"LAPSUS$",
				"DEV-0537",
				"Strawberry Tempest"
			],
			"source_name": "MITRE:LAPSUS$",
			"tools": [
				"Mimikatz"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1785204161,
	"ts_updated_at": 1792487391,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/7adcfbd2c034d8e53fb98beebd1eae28d22984ac.pdf",
		"text": "https://archive.orkl.eu/7adcfbd2c034d8e53fb98beebd1eae28d22984ac.txt",
		"img": "https://archive.orkl.eu/7adcfbd2c034d8e53fb98beebd1eae28d22984ac.jpg"
	}
}