new LAPSUS$
ObscureIQ Threat Intelligence · Actor Profile
new LAPSUS$Confidence: Medium
Collective / brand · rebrand / successor
Motivation: Financial; Notoriety
1Attributed Breaches
MediumAttribution Confidence
Collective / brandActor Type
Overview
A loose revival of the LAPSUS$ name rather than a clean continuation of the original crew, overlapping with 2025 Scattered Lapsus$ Hunters reporting that blended Scattered Spider, LAPSUS$, and ShinyHunters branding. Treat as an unstable brand pending campaign-specific attribution. Common pattern: social engineering, credential theft, and leak threats.
Tactics, Targeting & TTPs
Common pattern: social engineering, credential theft, extortion, leak threats. Attribution should be campaign-specific.
Related Clusters & Actors
LAPSUS$Scattered SpiderShinyHunters
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.