Deception Tech Snares Shiny Hunter Attacker’s IP Address

•
January 7, 2026    

Hacking the honeypot does not a master hacker make.

See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective

Ask the band of young hackers flying their cybercrime flag under the name “Scattered Lapsus$ Shiny Hunters.” The group – Shiny Hunters for short – has trumpeted its takedown of big targets, including major retailers, airlines and insurers, and has earned many millions in ransom payments while causing massive disruption and major economic damage.

The group recently added a new victim to its list of claimed conquests: Los Angeles-based threat intelligence firm Resecurity, which for nearly a decade tracked the individuals who later became part of the group, sharing its intelligence with law enforcement.

On Telegram, Shiny Hunters this past weekend proclaimed: “We have gained full access to REsecurity systems” and taken “everything,” including details of every employee names and their access tokens, numerous threat reports, a list of every one of the company’s customers, as well as “all internal chats and logs,” including detailed future business plans.

One problem for Shiny Hunters: As first reported by data breach chronicler “Dissent Doe,” the criminals fell into a honeytrap.

“Around October 2025, we noticed suspicious activity targeting one of our employees, Mark Kelly,” which is one of the firm’s “realistic, well-monitored decoy accounts that mimic high-value targets but are isolated from real assets,” and which it planted on a well-known cybercrime site, Resecurity told Information Security Media Group.

In response, an internal team “developed further courses of action – including provisioning a honeypot environment and honeytrap account – to observe the motives of the actor and their next steps,” and used “a decommissioned system acting as a ‘shiny object,'” as a lure, which the attacker fell for last November.

Talk about bruised egos for this collection of supposed prodigy criminals, part of a group largely comprised of adolescents, that sprang from the loosely organized collective known as The Com (see: Cybersecurity Trends: What’s in Store for Defenders in 2026?).

Shortly after the honeypot reveal, “the Telegram channel associated with one of the ‘Shiny Hunters’ (and variations) groups was deleted,” and “the actors began repeatedly contacting media to remove the name ‘Shiny Hunters,'” Resecurity said, as part of an apparent attempt to erase this blow to their reputation.

Members of The Com and its spinoffs already regularly rejigged or played with the name under which they operated, perhaps to foil attribution, spark headlines or channel a meaningless 6-7 tactic for trying to mess with defenders’ heads (see: Madman Theory Spurs Crazy Scattered Lapsus$ Hunters Playbook).

Before the latest – approximately now eighth – version of one of the collective’s Telegram channels disappeared, administrators also named dropped “IRDev” – an alias used by indicted American John Erin Binns, 24, who’s previously been tied to ShinyHunters.

A U.S. federal indictment charged Binns and fellow American Connor Riley Moucka, 25, with a 2024 hit on 165 customers of data warehousing platform Snowflake. Victims included Live Nation Entertainment’s Ticketmaster, Santander Bank, Advance Auto Parts, Los Angeles schools, Neiman Marcus, Bausch Health and AT&T, which lost call and text metadata for nearly all of its U.S. customers.

Security researchers said the pair used infostealers to obtain credentials, logged into Snowflake customer instances without multifactor authentication and stole data, which they held to ransom. Stolen information was offered sold on the cybercrime underground under the “ShinyHunters” banner.

The reference by Shiny Hunters to Binns’ alias, while no smoking gun, suggests he remains not only active on the hacking scene but potentially one of its members.

It’s a reminder too that while Moucka remains in U.S. custody – his trial in Seattle federal court is scheduled for Oct. 19 – Binns, aka IntelSecrets, appears to remain in Turkey, where he was arrested in May 2024 after the U.S. indicted him for the 2021 hack of T-Mobile. The United States is still seeking Binns’ extradition.

Resecurity said Binns has been criminally active in other ways, including by long-term haranguing of high-level American officials and members of the intelligence community, which has included leaking their personal data. The firm said it’s amassed intelligence on numerous messages he authored that “include attempts to harass U.S. government personnel, State Department officials and FBI staff, along with multiple instances of misinformation and deceptive tactics.”

Defensive Tech

Regardless of who’s involved in any given attack, the honeytrap episode is a reminder that using deception technology can be part of an effective counterintelligence program designed to sound alarms when sophisticated threat actors start probing, including by recycling credentials obtained by infostealers.

Scattered Lapsus$ Shiny Hunters has regularly taken the same group of tactics, techniques and procedures, and attempted to use them against a swath of organizations across the same sector. The more the group relies on the same TTPs, potentially the greater the chance to catch them out.

Both Office 365 and VPN tools offer useful, built-in capabilities for building out “emulated environments” and filling it with “fake information, all of which could attract malicious actors to engage in illegal activities” and give defenders “insights into their motives and tactics,” Resecurity said in a Dec. 24, 2025, blog post detailing strategies organizations can use to quickly put this tactic in place.

Not just any old system or data will do. To build its honeypot environment, the firm said it “used a combination of synthetic data, inactionable (useless) data and information from decommissioned systems with chatter, which appeared sufficiently interesting for the bad actor to log in and document himself.”

The firm said that due to technical errors, even when attempting to use proxies, the attacker not only logged into the honeypot – itself a potential crime – but while attempting to download many thousands of fake records also accidentally disclosed his real IP address, in a foreign country. The firm said it’s shared this information with relevant law enforcement organizations.

Extra points to anyone who not only deceives the criminal deceivers – wherever they are – but also potentially unmasks them.