Replace: Article up to date to replicate that the ShinyHunters says they weren’t concerned on this exercise. We have now up to date our story and title.
Menace actors related to the “Scattered Lapsus$ Hunters” (SLH) declare to have breached the methods of cybersecurity agency Resecurity and stolen inside knowledge, whereas Resecurity says the attackers solely accessed a intentionally deployed honeypot containing faux info used to watch their exercise.
In the present day, menace actors revealed screenshots on Telegram of the alleged breach, claiming they stole worker knowledge, inside communications, menace intelligence stories, and shopper info.
“We wish to announce that we now have gained full entry to REsecurity methods,” the group wrote on Telegram, claiming to have stolen “all inside chats and logs”, “full worker knowledge”, “menace intel associated stories”, and a “full shopper listing with particulars.”
Supply: BleepingComputer
As proof of their claims, the menace actors revealed screenshots they allege had been stolen from Resecurity, together with what seems to be a Mattermost collaboration occasion exhibiting communications between Resecurity workers and Pastebin personnel relating to malicious content material hosted on the text-sharing platform.
The menace actors, who discuss with themselves as “Scattered Lapsus$ Hunters” because of the alleged overlap between ShinyHunters, Lapsus$, and Scattered Spider menace actors, stated the assault was retaliation for what they declare are ongoing makes an attempt by Resecurity to socially engineer the group and be taught extra about its operations.
The menace actors say Resecurity workers pretended to be consumers in the course of the sale of an alleged Vietnam monetary system database, in search of free samples and extra info.
After publishing this text, the ShinyHunters spokesperson advised BleepingComputer that they weren’t concerned on this exercise. Whereas ShinyHunters has all the time claimed to be a part of Scattered Lapsus$ Hunters, they state they weren’t concerned on this assault.
We have now up to date our article with this info.
When you’ve got any info relating to this incident or different undisclosed assaults, you possibly can contact us confidentially by way of Sign at 646-961-3731 or at suggestions@bleepingcomputer.com.
Resecurity says it was a honeypot
Resecurity disputes the menace actor’s claims, stating that the allegedly breached methods should not a part of its professional manufacturing infrastructure however had been as a substitute a honeypot designed to draw and monitor the menace actors.
After BleepingComputer contacted Resecurity concerning the declare, they shared a report revealed on December 24, the place the corporate says it first detected a menace actor probing their publicly uncovered methods on November 21, 2025.
The corporate says its DFIR staff recognized reconnaissance indicators early and logged a number of IP addresses linked to the actor, together with these originating from Egypt and Mullvad VPN companies.
Resecurity stated it responded by deploying a “honeypot” account inside an remoted surroundings that allowed the menace actor to log in and work together with methods containing faux worker, buyer, and fee knowledge whereas it was being monitored by the researchers.
A honeypot is a intentionally uncovered, monitored system or account designed to lure attackers, permitting them to be noticed and analyzed and to assemble intelligence on their exercise with out risking actual knowledge or infrastructure.
The corporate says it populated the honeypot with artificial datasets designed to carefully resemble real-world enterprise knowledge. These included greater than 28,000 artificial client information and over 190,000 artificial fee transaction information, each generated from Stripe’s official API format.
In response to Resecurity, the menace actor started making an attempt to automate knowledge exfiltration in December, producing greater than 188,000 requests between December 12 and December 24 whereas utilizing giant numbers of residential proxy IP addresses.
Throughout this exercise, the corporate says it collected telemetry on the attacker’s ways, strategies, and infrastructure.
Supply: Resecurity
Resecurity claims that the attacker briefly uncovered confirmed IP addresses on a number of events as a consequence of proxy connection failures, and that the intel was reported to regulation enforcement.
After observing further exercise, Resecurity says it added additional faux datasets to review the attacker’s habits, which led to further OPSEC failures and helped slender down the menace actor’s infrastructure.
The agency says it later recognized servers used to automate the assault by way of residential proxies and shared the intelligence with regulation enforcement as effectively.
“As soon as the actor was positioned utilizing accessible community intelligence and timestamps, a overseas regulation enforcement group, a accomplice of Resecurity, issued a subpoena request relating to the menace actor,” says Resecurity.
On the time of writing, the menace actors haven’t supplied any additional proof, solely issuing a brand new Telegram submit stating that extra info shall be coming quickly.
“Good harm management Resecurity. Extra info coming quickly!,” reads a submit on Telegram.
Whether or not you are cleansing up previous keys or setting guardrails for AI-generated code, this information helps your staff construct securely from the beginning.
Get the cheat sheet and take the guesswork out of secrets and techniques administration.
