Hackers declare to hack Resecurity, agency says it was a honeypot

Replace: Article up to date to mirror that the ShinyHunters says they weren’t concerned on this exercise. We now have up to date our story and title.

Menace actors related to the “Scattered Lapsus$ Hunters” (SLH) declare to have breached the programs of cybersecurity agency Resecurity and stolen inner information, whereas Resecurity says the attackers solely accessed a intentionally deployed honeypot containing pretend data used to observe their exercise.

At this time, risk actors printed screenshots on Telegram of the alleged breach, claiming they stole worker information, inner communications, risk intelligence reviews, and shopper data.

“We want to announce that now we have gained full entry to REsecurity programs,” the group wrote on Telegram, claiming to have stolen “all inner chats and logs”, “full worker information”, “risk intel associated reviews”, and a “full shopper listing with particulars.”

As proof of their claims, the risk actors printed screenshots they allege have been stolen from Resecurity, together with what seems to be a Mattermost collaboration occasion exhibiting communications between Resecurity workers and Pastebin personnel relating to malicious content material hosted on the text-sharing platform.

The risk actors, who discuss with themselves as “Scattered Lapsus$ Hunters” because of the alleged overlap between ShinyHunters, Lapsus$, and Scattered Spider risk actors, mentioned the assault was retaliation for what they declare are ongoing makes an attempt by Resecurity to socially engineer the group and study extra about its operations.

The risk actors say Resecurity workers pretended to be consumers throughout the sale of an alleged Vietnam monetary system database, searching for free samples and extra data.

After publishing this text, the ShinyHunters spokesperson instructed BleepingComputer that they weren’t concerned on this exercise. Whereas ShinyHunters has at all times claimed to be a part of Scattered Lapsus$ Hunters, they state they weren’t concerned on this assault.

We now have up to date our article with this data.

You probably have any data relating to this incident or different undisclosed assaults, you may contact us confidentially through Sign at 646-961-3731 or at suggestions@bleepingcomputer.com.

Resecurity says it was a honeypot

Resecurity disputes the risk actor’s claims, stating that the allegedly breached programs aren’t a part of its legit manufacturing infrastructure however have been as an alternative a honeypot designed to draw and monitor the risk actors.

After BleepingComputer contacted Resecurity concerning the declare, they shared a report printed on December 24, the place the corporate says it first detected a risk actor probing their publicly uncovered programs on November 21, 2025.

The corporate says its DFIR group recognized reconnaissance indicators early and logged a number of IP addresses linked to the actor, together with these originating from Egypt and Mullvad VPN companies.

Resecurity mentioned it responded by deploying a “honeypot” account inside an remoted surroundings that allowed the risk actor to log in and work together with programs containing pretend worker, buyer, and fee information whereas it was being monitored by the researchers.

A honeypot is a intentionally uncovered, monitored system or account designed to lure attackers, permitting them to be noticed and analyzed and to collect intelligence on their exercise with out risking actual information or infrastructure.

The corporate says it populated the honeypot with artificial datasets designed to carefully resemble real-world enterprise information. These included greater than 28,000 artificial shopper information and over 190,000 artificial fee transaction information, each generated from Stripe’s official API format.

In accordance with Resecurity, the risk actor started making an attempt to automate information exfiltration in December, producing greater than 188,000 requests between December 12 and December 24 whereas utilizing massive numbers of residential proxy IP addresses.

Throughout this exercise, the corporate says it collected telemetry on the attacker’s techniques, strategies, and infrastructure.

Resecurity claims that the attacker briefly uncovered confirmed IP addresses on a number of events as a result of proxy connection failures, and that the intel was reported to legislation enforcement.

After observing extra exercise, Resecurity says it added additional pretend datasets to check the attacker’s conduct, which led to extra OPSEC failures and helped slim down the risk actor’s infrastructure.
The agency says it later recognized servers used to automate the assault through residential proxies and shared the intelligence with legislation enforcement as properly.

“As soon as the actor was positioned utilizing obtainable community intelligence and timestamps, a overseas legislation enforcement group, a companion of Resecurity, issued a subpoena request relating to the risk actor,” says Resecurity.

On the time of writing, the risk actors haven’t offered any additional proof, solely issuing a brand new Telegram publish stating that extra data will likely be coming quickly.

“Good harm management Resecurity. Extra data coming quickly!,” reads a publish on Telegram.