Topic starter
11/07/2026 8:27 pm
TL;DR: ShinyHunters, Lapsus$ and Scattered Spider appear to be re-emerging as a loose “Scattered LAPSUS$ Hunters” syndicate that markets extortion-as-a-service, a BreachForums successor and potential ransomware capability, with a small core group using Telegram, Tor and rented reputation to keep operating, according to Swarmnetics.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: “ShinyHunters, Lapsus$, Scattered Spider Cybercrime Gangs are Back as a Tag Team. Or Are They?”.
Key questions
Q: What breaks when cyber crime groups grow beyond a small core of members?
A: Once these groups move past a small team, they often need managers, contractors, and department-like functions to coordinate activity.
Q: Why does rented expertise increase the risk of identity abuse?
A: It lets attackers combine social engineering, access brokering and privilege abuse without keeping all skills inside one crew.
Q: How can defenders tell when a criminal brand is really a recurring service model?
A: Look for repeated communication channels, mirrored messaging, overlapping infrastructure, and the same monetisation pattern appearing under different names.
Practitioner guidance
- Strengthen help desk verification Require out-of-band verification and step-up checks for account recovery, password reset and MFA changes, especially for high-value workforce accounts and privileged users.
- Track adversary infrastructure reuse Correlate Telegram handles, Tor endpoints, domain patterns and impersonation behaviour so that bans or brand changes do not reset detection coverage.
- Harden privileged access pathways Limit standing privilege, require just-in-time elevation and isolate admin actions so a rented operator cannot easily pivot from social engineering to broad access.
Bottom line: Cybercrime syndicates are increasingly organised around reusable skills and trust mechanisms rather than fixed membership, which makes brand-based tracking less reliable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:56 pm
Cybercrime is becoming a services economy, not a team sport. The article describes a criminal model where expertise, reputation and infrastructure are rented across loosely linked actors instead of being owned by a single stable gang. That matters because disruption becomes harder when the function survives the brand. Defenders should track capability clusters, not just group names.
A question worth separating out:
Q: What should security teams prioritise if extortion crews can be hired on demand?
A: Prioritise the controls that interrupt handoff points: account recovery, help desk workflows, privileged elevation and third-party access. If an attacker can move from persuasion to access to extortion through separate specialists, every trust boundary becomes a control point. The goal is to make modular attack assembly too costly to scale.
👉 Read our full editorial: Cybercrime gangs are shifting toward syndicates and rented expertise