Replace: Article up to date to mirror that the ShinyHunters says they weren’t concerned on this exercise. We’ve up to date our story and title.
Menace actors related to the “Scattered Lapsus$ Hunters” (SLH) declare to have breached the techniques of cybersecurity agency Resecurity and stolen inside knowledge, whereas Resecurity says the attackers solely accessed a intentionally deployed honeypot containing pretend data used to observe their exercise.
At this time, menace actors printed screenshots on Telegram of the alleged breach, claiming they stole worker knowledge, inside communications, menace intelligence reviews, and shopper data.
“We wish to announce that we’ve gained full entry to REsecurity techniques,” the group wrote on Telegram, claiming to have stolen “all inside chats and logs”, “full worker knowledge”, “menace intel associated reviews”, and a “full shopper checklist with particulars.”
Supply: BleepingComputer
As proof of their claims, the menace actors printed screenshots they allege have been stolen from Resecurity, together with what seems to be a Mattermost collaboration occasion exhibiting communications between Resecurity staff and Pastebin personnel relating to malicious content material hosted on the text-sharing platform.
The menace actors, who consult with themselves as “Scattered Lapsus$ Hunters” because of the alleged overlap between ShinyHunters, Lapsus$, and Scattered Spider menace actors, stated the assault was retaliation for what they declare are ongoing makes an attempt by Resecurity to socially engineer the group and be taught extra about its operations.
The menace actors say Resecurity staff pretended to be patrons in the course of the sale of an alleged Vietnam monetary system database, in search of free samples and extra data.
After publishing this text, the ShinyHunters spokesperson informed BleepingComputer that they weren’t concerned on this exercise. Whereas ShinyHunters has at all times claimed to be a part of Scattered Lapsus$ Hunters, they state they weren’t concerned on this assault.
We’ve up to date our article with this data.
In case you have any data relating to this incident or different undisclosed assaults, you may contact us confidentially through Sign at 646-961-3731 or at suggestions@bleepingcomputer.com.
Resecurity says it was a honeypot
Resecurity disputes the menace actor’s claims, stating that the allegedly breached techniques will not be a part of its reliable manufacturing infrastructure however have been as an alternative a honeypot designed to draw and monitor the menace actors.
After BleepingComputer contacted Resecurity in regards to the declare, they shared a report printed on December 24, the place the corporate says it first detected a menace actor probing their publicly uncovered techniques on November 21, 2025.
The corporate says its DFIR crew recognized reconnaissance indicators early and logged a number of IP addresses linked to the actor, together with these originating from Egypt and Mullvad VPN companies.
Resecurity stated it responded by deploying a “honeypot” account inside an remoted surroundings that allowed the menace actor to log in and work together with techniques containing pretend worker, buyer, and fee knowledge whereas it was being monitored by the researchers.
A honeypot is a intentionally uncovered, monitored system or account designed to lure attackers, permitting them to be noticed and analyzed and to collect intelligence on their exercise with out risking actual knowledge or infrastructure.
The corporate says it populated the honeypot with artificial datasets designed to carefully resemble real-world enterprise knowledge. These included greater than 28,000 artificial client information and over 190,000 artificial fee transaction information, each generated from Stripe’s official API format.
In response to Resecurity, the menace actor started trying to automate knowledge exfiltration in December, producing greater than 188,000 requests between December 12 and December 24 whereas utilizing massive numbers of residential proxy IP addresses.
Throughout this exercise, the corporate says it collected telemetry on the attacker’s ways, methods, and infrastructure.
Supply: Resecurity
Resecurity claims that the attacker briefly uncovered confirmed IP addresses on a number of events as a result of proxy connection failures, and that the intel was reported to regulation enforcement.
After observing extra exercise, Resecurity says it added additional pretend datasets to check the attacker’s habits, which led to extra OPSEC failures and helped slim down the menace actor’s infrastructure.
The agency says it later recognized servers used to automate the assault through residential proxies and shared the intelligence with regulation enforcement as effectively.
“As soon as the actor was situated utilizing accessible community intelligence and timestamps, a international regulation enforcement group, a accomplice of Resecurity, issued a subpoena request relating to the menace actor,” says Resecurity.
On the time of writing, the menace actors haven’t offered any additional proof, solely issuing a brand new Telegram submit stating that extra data might be coming quickly.
“Good injury management Resecurity. Extra data coming quickly!,” reads a submit on Telegram.
Whether or not you are cleansing up outdated keys or setting guardrails for AI-generated code, this information helps your crew construct securely from the beginning.
Get the cheat sheet and take the guesswork out of secrets and techniques administration.
