Scattered LAPSUS$ Hunters Ransomware Decryption & Data Recovery

Scattered LAPSUS$ Hunters (SLSH, also SLH, dubbed the "Trinity of Chaos") surfaced on Telegram in August 2025, claiming members from ShinyHunters, Scattered Spider and LAPSUS$. It is a loose alliance inside The Com, not a single crew.

Its 2025 storyline runs through the Salesforce ecosystem: the August abuse of Salesloft Drift integration OAuth tokens, for which the alliance claimed credit on Telegram although that attribution remains disputed; a leak site launched on 3 October naming 39 companies and claiming close to a billion Salesforce records, which Salesforce publicly refused to pay for; and a November claim of roughly 285 further instances via Gainsight, alongside the ShinySp1d3r encryptor and open bidding for insider access. The actors put their victim count near 1,500 by mid-November 2025. Every one of these figures comes from the attackers and is not independently verified.

Through 2026 the alliance has grown looser. Google Threat Intelligence tracks functional clusters as UNC6040, UNC6240, UNC6661 and UNC6671 - a compartmentalised model where each stage sits with different participants - and a new ShinyHunters-branded leak site appeared in late January 2026. Claims that the crew had retired circulated mid-year, but the leak site and the extortion activity continued. Vendor reporting records an August 2026 healthcare incident in which the actors claimed over 200 million records exfiltrated in four days and demanded 55 million USD.

For Chinese enterprises the exposure is the multinational SaaS and identity estate, not the local file server. No public report documents a targeted campaign against mainland China organisations.

The first sign is usually notification, not broken files: extortion mail from an unfamiliar domain carrying a BTC address and a 72-hour countdown, a callout in a Telegram channel, a leak-site entry, or harassing calls to staff.

Identity and SaaS telemetry matters more than the endpoint:

• Unexpected MFA enrolments in Okta or Entra ID, with the "security method enrolled" notice silently deleted by a third-party OAuth app of the ToogleBox Recall type.
• Sign-ins concentrated on VPN and residential proxies such as Mullvad, Oxylabs and NetNut.
• Newly authorised connected apps in Salesforce, usually after an employee was walked through /setup/connect by phone.
• Keyword sweeps for proposal, internal, confidential or salesforce followed by bulk export, and PowerShell downloads from SharePoint or OneDrive.

If ShinySp1d3r was deployed: files gain an eight-character random extension (public samples show .XHuch5gq and .GcfVmSz3). The extension varies from file to file - public reverse engineering shows each build derives a fixed pool of candidate extensions and assigns them per file - so inconsistent extensions do not mean several families are present. Each directory gets a note named R3ADME_ plus a string from the same pool, the wallpaper is replaced, and the note supplies only a Tox ID and a Case ID.

The alliance leans on people and tokens rather than on malware delivery:

• Voice phishing. Operators impersonate the IT help desk, often calling personal mobiles, scaling with AI voice platforms such as Vapi and Bland AI.
• Adversary-in-the-middle portals. Cloned Okta and SSO pages relay credentials and MFA codes live; the actor then enrols their own MFA device for durable access.
• Insider recruitment. Telegram channels openly bid for Okta, Microsoft SSO and Citrix access across credit bureaus, insurance, finance, retail and hospitality.
• Supply chain. OAuth tokens from third-party integrations (Salesloft Drift, Gainsight) are hijacked, and privileged engineering accounts on Git, BrowserStack and JFrog are targeted to reach CI/CD.
• SIM swapping and MFA fatigue, with exfiltration over MEGA, Google Drive and LimeWire.

Some reporting also lists exploitation of internet-facing identity middleware as an entry route, but that attribution lacks reviewable public evidence and should not reshape your priorities: the repeatedly confirmed entry points remain help-desk procedures and third-party integration tokens.

Once SaaS and identity access is obtained, they usually move straight to exfiltration and extortion rather than pivoting internally - which is why endpoint tooling often records nothing.

One misconception first: most incidents attributed to this group involve no encryption. Bitdefender's September 2026 debrief states that despite the early-2026 fanfare, encryptors have not featured in recent attacks, and that distributing credentials and stolen data remains the primary revenue stream.

What public analysis of the ShinySp1d3r encryptor shows (Windows build):

• ChaCha20 for file content, session keys wrapped with RSA-2048 (OAEP), no Poly1305 authentication tag.
• Files above 100 MiB are only partially encrypted via keystream seeking, so large databases and virtual disks may retain substantial untouched data.
• Recovery inhibition: shadow copies deleted, event logs cleared, thirty-plus processes killed (SQL Server included), optional free-space wiping.
• A note prefixed R3ADME_ per directory plus a wallpaper change; extensions vary per file and, like the note's random string, are drawn from a pool the build generates in advance.
• Lateral deployment via WMI, SCM, GPO, SMB or PsExec, off by default in analysed samples.

Public analysis covers Windows samples only. Vendors describe Linux and ESXi modules in development, the ESXi variant reportedly using AES-256, but as of September 2026 no public sample or real-world deployment has been verified, which is why this page lists Windows alone.