Threat actor

Scattered LAPSUS$ Hunters

In 8 briefs, most recently 26 February 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. UNC2814 espionage hit 53 orgs in 42 countries; Cisco SD-WAN flaw CVE-2026-20127 drew a CISA emergency directive; CarGurus breach hits 12M users.
  2. Chrome zero-day CVE-2026-2441, CISA's BeyondTrust order, and the Dior/Louis Vuitton/Tiffany $25M Korean fine tied to Scattered LAPSUS$ Hunters Salesforce …
  3. Pear ransomware hits Tri-Century Eye Care; React2Shell and ICTBroadcast flaws exploited; malicious VS Code extensions found in Microsoft Marketplace.
  4. Gainsight breach expands to more Salesforce customers, Shai-Hulud v2 npm-to-Maven supply chain attack, and Qilin ransomware hits South Korean MSP. Plus London …
  5. The Oracle EBS extortion campaign hitting Cox, Canon and Mazda, the Shai-Hulud npm malware wave, and Harvard's voice phishing breach, plus new zero-days.
  6. The Salesforce Gainsight breaches by ShinyHunters, the CrowdStrike insider leak, and the actively exploited Oracle Identity Manager flaw (CVE-2025-61757).
  7. Discord Zendesk breach affecting 5.5M users, Qilin's Asahi brewery leak, and a LockBit-Qilin-DragonForce ransomware cartel.
  8. Covers Asahi ransomware, Salesforce data extortion by ShinyHunters, Jaguar Land Rover repeat attacks, and CISA-flagged Meteobridge root RCE exploited in the …