Cybersecurity researchers have tied a contemporary spherical of cyber assaults focusing on monetary providers to the infamous cybercrime group referred to as Scattered Spider, casting doubt on their claims of going “darkish.”
Risk intelligence agency ReliaQuest stated it has noticed indications that the menace actor has shifted their focus to the monetary sector. That is supported by a rise in lookalike domains probably linked to the group which are geared in the direction of the business vertical, in addition to a just lately recognized focused intrusion in opposition to an unnamed U.S. banking group.
“Scattered Spider gained preliminary entry by socially engineering an govt’s account and resetting their password through Azure Lively Listing Self-Service Password Administration,” the corporate stated.
“From there, they accessed delicate IT and security paperwork, moved laterally by the Citrix surroundings and VPN, and compromised VMware ESXi infrastructure to dump credentials and additional infiltrate the community.”
To realize privilege escalation, the attackers reset a Veeam service account password, assigned Azure World Administrator permissions, and relocated digital machines to evade detection. There are additionally indicators that Scattered Spider tried to exfiltrate knowledge from Snowflake, Amazon Net Companies (AWS), and different repositories.
Exit or Smokescreen?
The current exercise undercuts the group’s claims that they have been ceasing operations alongside 14 different felony teams, resembling LAPSUS$. Scattered Spider is the moniker assigned to a loose-knit hacking collective that is a part of a broader on-line entity known as The Com.
The group additionally shares a excessive diploma of overlap with different cybercrime crews like ShinyHunters and LAPSUS$, a lot in order that the three clusters shaped an overarching entity named “scattered LAPSUS$ hunters.”
One in every of these clusters, notably ShinyHunters, has additionally engaged in extortion efforts after exfiltrating delicate knowledge from victims’ Salesforce cases. In these circumstances, the exercise occurred months after the targets have been compromised by one other financially motivated hacking group tracked by Google-owned Mandiant as UNC6040.
The incident is a reminder to not be lulled right into a false sense of security, ReliaQuest added, urging organizations to remain vigilant in opposition to the menace. As within the case of ransomware teams, there isn’t any such factor as retirement, as it’s extremely a lot doable for them to regroup or rebrand beneath a distinct alias sooner or later.
“The current declare that Scattered Spider is retiring must be taken with a big diploma of skepticism,” Karl Sigler, security analysis supervisor of SpiderLabs Risk Intelligence at Trustwave, a LevelBlue Firm, stated. “Somewhat than a real disbanding, this announcement possible indicators a strategic transfer to distance the group from rising regulation enforcement stress.”
Sigler additionally identified that the farewell letter must be considered as a strategic retreat, permitting the group to reassess its practices, refine its tradecraft, and evade ongoing efforts to place a lid on its actions, to not point out complicate attribution efforts by making it tougher to tie future incidents to the identical core actors.
“It is believable that one thing throughout the group’s operational infrastructure has been compromised. Whether or not by a breached system, an uncovered communication channel, or the arrest of lower-tier associates, one thing has possible triggered the group to go darkish, no less than quickly. Traditionally, when cybercriminal teams face heightened scrutiny or undergo inside disruption, they usually ‘retire’ in title solely, opting as an alternative to pause, regroup, and ultimately re-emerge beneath a brand new identification.”
Replace
In a brand new evaluation revealed on September 17, 2025, EclecticIQ stated ShinyHunters is probably going counting on members of Scattered Spider and The Com to facilitate voice phishing assaults utilizing platforms resembling Vapi and Bland AI that present unauthorized entry to single sign-on (SSO) platforms utilized by retail, airline, and telecom corporations.
Particularly, ShinyHunters members have been discovered to abuse Bland AI to automate social engineering calls at scale, permitting them to tailor responses to sufferer’s reactions throughout cellphone calls in real-time, and making certain that the decision stays convincing even in situations the place the responds exterior the scripted conversational pathways.
The voice name phishing assaults are carried out by people who’re recruited by ShinyCorp (aka sp1d3rhunters), the mastermind behind ShinyHunters, by Telegram teams resembling Sim Land (SL), an underground neighborhood operated by The Com members.
“Not like static robotic voice calls, the AI mannequin dynamically generates voices and adjusts tone and responses to maintain credibility and manipulate the goal,” EclecticIQ stated. “This mix of LLM-powered dialogue administration and near-realistic artificial voice permits ShinyHunters linked menace actors to run profitable vishing operations at scale.”
The entry is then leveraged to siphon giant volumes of buyer knowledge from compromised Salesforce purposes for subsequent extortion efforts. In keeping with the Dutch cybersecurity firm, ShinyHunters has additionally impersonated Okta SSO login pages to steal credentials from high-value sectors together with funding banking, luxurious retail, journey, U.S. cost processing, and main e-commerce platforms.
On high of that, the extortion group has claimed to have stolen over 1.5 billion Salesforce data from 760 corporations utilizing compromised Salesloft Drift OAuth tokens, per a report from Bleeping Laptop. Google is monitoring the exercise related to the Salesloft hack beneath the moniker UNC6395.
What’s extra, ShinyHunters is claimed to have obtained BrowserStack API keys created by engineering groups and used them to focus on enterprise growth environments, in addition to exploited an Oracle Entry Supervisor vulnerability (CVE-2021-35587) in assaults focusing on a nationwide financial institution and a Japanese automobile producer to realize entry to the database and exfiltrate knowledge.
“ShinyHunters is increasing its operations by combining AI-enabled voice phishing, provide chain compromises, and leveraging malicious insiders, resembling workers or contractors, who can present direct entry to enterprise networks,” security researcher Arda Büyükkaya stated.
“ShinyHunters chief, ShinyCorp, is actively promoting stolen datasets with ransomware associates and different e-crime actors, at costs exceeding $1 million per firm.”
