Replace: Article up to date to mirror that the ShinyHunters says they weren’t concerned on this exercise. We’ve got up to date our story and title.
Menace actors related to the “Scattered Lapsus$ Hunters” (SLH) declare to have breached the methods of cybersecurity agency Resecurity and stolen inside information, whereas Resecurity says the attackers solely accessed a intentionally deployed honeypot containing faux info used to watch their exercise.
As we speak, risk actors revealed screenshots on Telegram of the alleged breach, claiming they stole worker information, inside communications, risk intelligence studies, and consumer info.
“We want to announce that we’ve got gained full entry to REsecurity methods,” the group wrote on Telegram, claiming to have stolen “all inside chats and logs”, “full worker information”, “risk intel associated studies”, and a “full consumer record with particulars.”
Supply: BleepingComputer
As proof of their claims, the risk actors revealed screenshots they allege have been stolen from Resecurity, together with what seems to be a Mattermost collaboration occasion exhibiting communications between Resecurity workers and Pastebin personnel relating to malicious content material hosted on the text-sharing platform.
The risk actors, who discuss with themselves as “Scattered Lapsus$ Hunters” as a result of alleged overlap between ShinyHunters, Lapsus$, and Scattered Spider risk actors, stated the assault was retaliation for what they declare are ongoing makes an attempt by Resecurity to socially engineer the group and be taught extra about its operations.
The risk actors say Resecurity workers pretended to be consumers throughout the sale of an alleged Vietnam monetary system database, looking for free samples and extra info.
After publishing this text, the ShinyHunters spokesperson advised BleepingComputer that they weren’t concerned on this exercise. Whereas ShinyHunters has all the time claimed to be a part of Scattered Lapsus$ Hunters, they state they weren’t concerned on this assault.
We’ve got up to date our article with this info.
When you have any info relating to this incident or different undisclosed assaults, you may contact us confidentially through Sign at 646-961-3731 or at suggestions@bleepingcomputer.com.
Resecurity says it was a honeypot
Resecurity disputes the risk actor’s claims, stating that the allegedly breached methods will not be a part of its reputable manufacturing infrastructure however have been as an alternative a honeypot designed to draw and monitor the risk actors.
After BleepingComputer contacted Resecurity in regards to the declare, they shared a report revealed on December 24, the place the corporate says it first detected a risk actor probing their publicly uncovered methods on November 21, 2025.
The corporate says its DFIR staff recognized reconnaissance indicators early and logged a number of IP addresses linked to the actor, together with these originating from Egypt and Mullvad VPN companies.
Resecurity stated it responded by deploying a “honeypot” account inside an remoted setting that allowed the risk actor to log in and work together with methods containing faux worker, buyer, and cost information whereas it was being monitored by the researchers.
A honeypot is a intentionally uncovered, monitored system or account designed to lure attackers, permitting them to be noticed and analyzed and to assemble intelligence on their exercise with out risking actual information or infrastructure.
The corporate says it populated the honeypot with artificial datasets designed to carefully resemble real-world enterprise information. These included greater than 28,000 artificial shopper data and over 190,000 artificial cost transaction data, each generated from Stripe’s official API format.
In line with Resecurity, the risk actor started trying to automate information exfiltration in December, producing greater than 188,000 requests between December 12 and December 24 whereas utilizing giant numbers of residential proxy IP addresses.
Throughout this exercise, the corporate says it collected telemetry on the attacker’s techniques, strategies, and infrastructure.
Supply: Resecurity
Resecurity claims that the attacker briefly uncovered confirmed IP addresses on a number of events on account of proxy connection failures, and that the intel was reported to legislation enforcement.
After observing further exercise, Resecurity says it added additional faux datasets to check the attacker’s habits, which led to further OPSEC failures and helped slim down the risk actor’s infrastructure.
The agency says it later recognized servers used to automate the assault through residential proxies and shared the intelligence with legislation enforcement as effectively.
“As soon as the actor was situated utilizing out there community intelligence and timestamps, a international legislation enforcement group, a companion of Resecurity, issued a subpoena request relating to the risk actor,” says Resecurity.
On the time of writing, the risk actors haven’t offered any additional proof, solely issuing a brand new Telegram put up stating that extra info can be coming quickly.
“Good injury management Resecurity. Extra info coming quickly!,” reads a put up on Telegram.
As MCP (Mannequin Context Protocol) turns into the usual for connecting LLMs to instruments and information, safety groups are shifting quick to maintain these new companies protected.
This free cheat sheet outlines 7 finest practices you can begin utilizing immediately.
