Stay ahead with breaking tech news, gadget reviews, AI & software innovations, cybersecurity tips, start‑up trends, and step‑by‑step how‑tos.
Ransomware Group ‘Scattered lapsus ShinyHunters’ Employs Extreme Tactics, Experts Urge: Do Not Pay
Table of Contents
- 1. Ransomware Group ‘Scattered lapsus ShinyHunters’ Employs Extreme Tactics, Experts Urge: Do Not Pay
- 2. The New Face of Cyber Extortion
- 3. How SLSH Gains Access And Operates
- 4. The Com Connection and Unpredictability
- 5. The Consensus: Do Not Engage
- 6. What is ShinyHunters and why should executives never pay them?
- 7. ShinyHunters: The Extortion Gang that Threatens Executives,Families,and Media Wiht Swatting—Why You Should Never Pay
- 8. Who is ShinyHunters?
- 9. The Horrifying reality of Swatting
- 10. How ShinyHunters Operates: A Breakdown
- 11. Why Paying the Ransom is a Terrible Idea
- 12. Real-World Examples & Case Studies
- 13. Protecting Yourself and Your Association
A notably aggressive data extortion group, known as scattered lapsus ShinyHunters (SLSH), is escalating its tactics beyond typical Ransomware, according to cybersecurity experts. The group is distinguished by its relentless harassment of victims, including threats against families adn “swatting” incidents, alongside the standard data theft and extortion demands. This disturbing trend is prompting security professionals to advise companies against engaging with the criminals, even to negotiate.
The New Face of Cyber Extortion
Unlike many Ransomware operations originating in Russia, which often adhere to a degree of predictable behaviour, SLSH operates with a chaotic and fluid structure. This makes it challenging to anticipate their actions or trust any promises they might make. Allison nixon, Director of Research at Unit 221B, a New York City-based security consultancy, has been closely monitoring the group’s activities, noting their distinct departure from established Ransomware protocols.
Traditional Ransomware groups often limit their pressure to data leaks and denial-of-service attacks. SLSH, though, frequently resorts to intense personal threats, targeting executives and their families with harassment and, in certain specific cases, orchestrating false emergency reports to trigger armed police responses at their homes – a practice known as “swatting.” The Cybersecurity and Infrastructure Security Agency (CISA) has issued multiple warnings about the increasing prevalence of “swatting” attacks linked to cybercrime as recently as December 2023.
How SLSH Gains Access And Operates
SLSH commonly gains initial access to corporate networks thru refined phishing campaigns, frequently enough conducted via phone calls where attackers impersonate IT staff. They than leverage stolen credentials to infiltrate systems and extract sensitive data. google’s Mandiant security team reported in January 2026 that SLSH members have been successfully phoning IT staff pretending to update Multi-Factor Authentication settings, tricking employees into revealing crucial security information.
once inside a network, SLSH doesn’t simply demand a Ransomware payment for data decryption. Instead, they employ a multi-pronged strategy designed to inflict maximum pressure on the victim. This involves broadcasting the breach on Telegram channels, contacting journalists and regulators, and initiating continuous harassment. According to Nixon, this coordinated approach aims to overwhelm the institution and push them towards capitulation.
The Com Connection and Unpredictability
A meaningful factor contributing to SLSH’s erratic behavior is its connection to “The Com,” a decentralized network of cybercrime communities on platforms like Discord and Telegram. This network fosters a culture of infighting, betrayal, and instability, making it difficult for SLSH to maintain consistent operational security. The group’s members are frequently observed engaging in disputes and undermining each other, hindering their ability to execute successful, long-term Ransomware operations.
| Characteristic | SLSH | Traditional Ransomware Groups |
|---|---|---|
| Structure | Fluid, Unpredictable | Highly Regimented |
| tactics | Personal Threats, Swatting, Media Manipulation | Data Encryption, Data Leaks |
| Reliability | Unreliable, Promises Often Broken | More Likely to Honor Agreements (though not guaranteed) |
| Origin/Affiliation | The Com Network | Often Russia-Based |
The Consensus: Do Not Engage
Experts overwhelmingly advise against negotiating with or paying SLSH. Nixon stresses that paying does not guarantee the safe return of data or the cessation of harassment, and may, in fact, escalate the situation. The group’s history demonstrates a clear pattern of failing to uphold its end of any bargain. The FBI continues to advise against paying Ransomware demands in any circumstance, citing that it fuels further criminal activity. further information is available on the FBI’s internet Crime Complaint Center (IC3) website.
“The breached data will never go back to the way it was, but you can assure that the harassment will end,” Nixon stated.“Your decision to pay should be separate from the harassment. Refusing payment is the best course of action.”
Have you or your organization been targeted by similar extortion tactics? What steps are you taking to improve your cybersecurity defenses against thes evolving threats?
Share your thoughts and experiences in the comments below.
What is ShinyHunters and why should executives never pay them?
ShinyHunters: The Extortion Gang that Threatens Executives,Families,and Media Wiht Swatting—Why You Should Never Pay
ShinyHunters is a prolific cybercriminal group known for data breaches,extortion,and a particularly terrifying tactic: swatting. This article dives deep into their operations, the risks they pose, and, crucially, why giving in to their demands is the worst possible course of action. We’ll cover everything from their targets and methods to protective measures and legal ramifications. Understanding this threat is vital for anyone in a leadership position,involved in media,or simply concerned about online security.
Who is ShinyHunters?
Emerging around 2020,ShinyHunters quickly gained notoriety for compromising numerous high-profile companies. Unlike ransomware groups that encrypt data, ShinyHunters primarily steals it. Their targets include businesses across various sectors – retail, technology, and even healthcare – but they’ve increasingly focused on individuals, particularly executives and their families.
They operate on dark web forums, selling stolen databases containing sensitive data like personally Identifiable Information (PII), email addresses, passwords, and financial data.However, their business model extends beyond simple data sales. They leverage the stolen information for direct extortion, and increasingly, the threat of “swatting.”
The Horrifying reality of Swatting
Swatting is a hazardous and illegal practice where a false report is made to emergency services, leading to a heavily armed police response (often a SWAT team) being dispatched to the victim’s location. ShinyHunters uses stolen data to convincingly impersonate their victims or their family members, fabricating emergencies to trigger a swatting incident.
This isn’t just a scare tactic. Swatting can have devastating consequences:
* Physical Harm: Innocent individuals can be injured or killed during a swatting incident.
* Emotional trauma: The experience is deeply traumatizing for victims and their families.
* Legal Repercussions: Even if no one is physically harmed, victims can face legal issues and significant emotional distress.
* Reputational Damage: Public figures targeted by swatting can suffer significant damage to their reputation.
How ShinyHunters Operates: A Breakdown
shinyhunters’ operations can be broken down into several key stages:
- Data Breach: They exploit vulnerabilities in company systems,often using credential stuffing (using stolen usernames and passwords from previous breaches) or exploiting misconfigured APIs.
- Data Collection: Once inside, they exfiltrate massive amounts of data, focusing on PII and sensitive corporate information.
- Data Sale & Extortion: They sell the stolen data on dark web marketplaces. Simultaneously, they contact individuals and companies directly, demanding payment to prevent the data from being sold or leaked.
- Swatting Threat (and Execution): If demands aren’t met, ShinyHunters escalates the threat to swatting, often revealing they possess enough personal information to make the threat credible. They have, in multiple documented cases, followed through on these threats.
- Repeat: The cycle continues as they target new victims.
Why Paying the Ransom is a Terrible Idea
Despite the terrifying nature of the threats, security experts universally advise against paying ShinyHunters (or any cybercriminal group).Here’s why:
* No Guarantee: there’s absolutely no guarantee that ShinyHunters will delete the data or refrain from swatting even after receiving payment. They are criminals, and their word cannot be trusted.
* Encourages Further Attacks: Paying incentivizes them and other groups to continue their activities,making everyone a potential target.
* Funds Criminal Activity: Your payment directly supports their operations and allows them to harm others.
* Potential Legal Issues: In some jurisdictions, paying ransom to cybercriminals may be illegal.
* You Become a Target: once you’ve paid, you’re likely to be considered a soft target and may be extorted again in the future.
Real-World Examples & Case Studies
ShinyHunters has been linked to numerous high-profile breaches. In 2020, they claimed responsibility for breaches at companies like Tokopedia (Indonesia’s largest e-commerce platform) and numerous other online services. More recently, they’ve targeted individuals connected to media organizations, escalating the threat of swatting.
Several documented cases demonstrate the severity of their swatting tactics. While details are often kept confidential to protect victims, law enforcement agencies have confirmed responding to swatting incidents directly linked to ShinyHunters’ extortion attempts. These incidents have resulted in arrests and ongoing investigations.
Protecting Yourself and Your Association
While preventing all attacks is impractical,you can substantially reduce your risk:
* Strong Passwords & MFA: Implement strong,unique passwords and multi-factor authentication (MFA) on all accounts.
* Password Managers: Encourage the use of reputable password managers.
* Regular Security Audits: Conduct regular security audits to identify and address vulnerabilities in your systems.
* Employee Training: Train employees to recognise and avoid phishing scams and other social engineering tactics.
* Data Breach Monitoring: Monitor dark web forums and data breach notification sites for compromised credentials.
* Incident Response Plan: Develop and regularly test an incident response plan to prepare for a potential breach.
* Physical Security Awareness: Be mindful of the information you share online and the potential for it to be used for swatting.
* report Threats: Promptly report any extortion attempts or threats to law enforcement. the FBI’s