Scattered LAPSUS$ Hunters Announces Closure

A band of adolescent hackers behind attacks against airliners, insurers and casinos in the United Kingdom and the United States on Friday said they are shutting down their operations.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Scattered Lapsus$ Hunters posted a semi-coherent screed on Friday announcing a decision to “go dark,” after a purported “72 hours spent in silence.” The group recently claimed the attack on British carmaker Jaguar Land Rover that has paralyzed the automakers global operations (see: Jaguar Land Rover Hackers Stole Data).

“We LAPSUS$, Trihash, Yurosh, Yaxsh, WyTroZz, N3z0x, Nitroz, TOXIQUEROOT, Prosox, Pertinax, Kurosh, Clown, IntelBroker, Scattered Spider, Yukari and among many others, have decided to go dark,” the group said. “Our objectives having been fulfilled, it is now time to say goodbye.”

The group claimed to have hacked Google at least four times, as well as “blowing up” security firms Salesforce and CrowdStrike. The group also threatened to leak data of luxury clothing line Will Kering, Air France, American Airlines and British Airlines.

Future data leaks do “not mean we are still active,” the group said.

The hacking groups came out of a decentralized hacking network known as “The Community,” or “The Com,” which has been previously linked to high-profile attacks on more than 130 companies, including MGM Resorts, Clorox and cryptocurrency exchange Coinbase.

ShinyHunters and Lapsus$ focused on theft, extortion and service disruption, while Scattered Spider deployed ransomware for data extortion. All the groups primarily used social engineering tactics such as SIM-swapping and phishing, often impersonating help desk staff to bypass multi-factor authentication protections to target their victims.

ShinyHunters targeted Google, Cisco and Salesforce using voice phishing. British retailers Marks & Spencer and Co-op were targeted through social engineering, impersonating IT help desk staff. The hacking group deployed DragonForce ransomware to encrypt the victim network (see: Retail Sector in Scattered Spider Crosshairs).

In the wake of the hacks, Western law enforcement agencies increased their crackdown on the group and its members. A key figure, Noah Michael Urban, 20, received a 10 year prison sentence from a Jacksonville, FL federal judge after earlier pleading guilty.

In July, British law enforcement agencies arrested four suspected Scattered Spider members for their roles in Marks & Spencer and the Co-op hacks. Canadian police arrested in November Alexander Moucka, also a Scattered Spider member, on charges tied to stealing terabytes of data from clients of cloud-based data warehousing platform Snowflake, potentially under the Scattered Spider banner.

In 2022, Moroccan police arrested French national Sébastien Raoult, aka ShinyHunters member “Sezyo,” at an airport in Morocco. He was later extradited to the U.S. and sentenced to a three-year prison sentence and ordered to pay more than $5 million in restitution for committing wire fraud and aggravated identity theft.

The group’s declaration of cease fire is likely an indication its members are panicking over potential arrest – or setting the stage for a rebrand, said Cian Heasley, principal consultant at Acumen Cyber.

“It’s more likely members are having internal disagreements around how to proceed under the threat of prison time, how high a profile they want to maintain in the media and the cybercrime underground and whether to lie low until the dust settles,” Heasley said, adding that the hackers will likely to regroup.

Christiaan Beek, senior director of threat intelligence and analytics at Rapid7, called the announcement is more “tactical than conclusive,” likely intended to “lower their profile, or test reactions.”

“Unless there are clear signs – like long-term silence on their channels, known personas disappearing, or takedown notices from service providers – we should treat this as a claim that may or may not reflect their actual operational status,” Beek told Information Security Media Group.