Scattered Lapsus$ Hunters extortion website goes down

Is it really the end of the road for the notorious Scattered Lapsus$ Hunters? Last week, law enforcement seized the group's dark web and clearnet domains, the latest blow to the alliance that had threatened to publish Salesforce data allegedly stolen from 39 companies, including Google, in a massive social engineering attack.

See also: Scattered Lapsus$ Hunters claim to have stolen over 1 billion Salesforce files

However, one of the group’s dark web sites remained accessible. As promised, on October 10 at 11:59 p.m. EDT, the group used it to leak data stolen from half a dozen companies, in what a Telegram message claimed would be the group’s farewell blow before retirement. The companies whose names appeared on the site before it disappeared late Saturday were Qantas Airways, Vietnam Airlines, Albertsons Companies, GAP Inc, Fujifilm Holdings and Engie Resources. CSO Online has not directly verified the data posted on the leak site, but the number of files allegedly released ranged from 5.7 million files (153GB) for Qantas to 537,000 (3GB) in the case of Engie Resources.

Despite the leak, as well as uncertainty about the fate of other data that may have been obtained during the campaign against Salesforce customers, last week’s operation suggests that law enforcement is becoming more effective at disrupting the infrastructure used by some ransomware. However, in a characteristically ironic Telegram post attributed to the Scattered Lapsus$ Hunters, the group promised that it would return in 2026 with a new subscription-based “ransomware-as-a-service” platform. This would be “similar to how a RaaS [ransomware-as-a-service] program works but without the locking/encryption,” the group said in a message, which has since been removed from Telegram. Customers could “use our name to blackmail their target,” with the idea that the group’s name would make victims more likely to respond.

See also: Scattered Lapsus$ Hunters: Salesforce data leak site – 39 companies victims

Stolen data remains at risk

Meanwhile, other data stolen during the Salesforce campaign will remain at risk. It’s very likely that it will leak to other criminal enterprises at some point. It’s this simple asymmetry that has turned data breaches into a huge business: stolen data can never be “recovered” and exists in a compromised state forever. This remains true whether a ransom is paid or not.

“We do not expect the activity of these threat actors to decline, and they remain a real threat to businesses due to their social engineering skills and deep knowledge of enterprise software support processes and supply chains,” said Jeremy Kirk of Intel 471.This points to another underlying problem that allows ransomware perpetrators to thrive: they often know where weaknesses in technology and processes lie before defenders do.

See also: Scattered Spider targets the financial sector

These criminals are also banding together to become more effective; the Scattered Lapsus$ Hunters are not the only alliance in the cybercrime world. In another recent development, three of the largest Russian ransomware operations, DragonForce, Qilin and LockBit, announced that they had formed a criminal cartel aimed at coordinating attacks and sharing resources in response to what they described as a “challenging” extortion environment.