The ShinyHunters hacking group claims it breached the methods of cybersecurity agency Resecurity and stole inside information, whereas Resecurity says the attackers solely accessed a intentionally deployed honeypot containing pretend data used to observe their exercise.
As we speak, the menace actors printed screenshots on Telegram of the alleged breach, claiming to have stolen worker information, inside communications, menace intelligence experiences, and shopper data.
“We wish to announce that we have now gained full entry to REsecurity methods,” the group wrote on Telegram, claiming to have stolen “all inside chats and logs”, “full worker information”, “menace intel associated experiences”, and a “full shopper record with particulars.”
Supply: BleepingComputer
As proof of their claims, the menace actors printed screenshots they allege had been stolen from Resecurity, together with what seems to be a Mattermost collaboration occasion exhibiting communications between Resecurity staff and Pastebin personnel relating to malicious content material hosted on the text-sharing platform.
The menace actors, who discuss with themselves as “Scattered Lapsus$ Hunters” as a result of alleged overlap between ShinyHunters, Lapsus$, and Scattered Spider menace actors, stated the assault was retaliation for what they declare are ongoing makes an attempt by Resecurity to socially engineer the group and study extra about its operations.
ShinyHunters says Resecurity staff pretended to be patrons through the sale of an alleged Vietnam monetary system database, looking for free samples and extra data.
In case you have any data relating to this incident or different undisclosed assaults, you’ll be able to contact us confidentially by way of Sign at 646-961-3731 or at suggestions@bleepingcomputer.com.
Resecurity says it was a honeypot
Resecurity disputes ShinyHunters’ claims, stating that the allegedly breached methods are usually not a part of its professional manufacturing infrastructure however had been as a substitute a honeypot designed to draw and monitor the menace actors.
After BleepingComputer contacted Resecurity concerning the declare, they shared a report printed on December 24, the place the corporate says it first detected a menace actor probing their publicly uncovered methods on November 21, 2025.
The corporate says its DFIR workforce recognized reconnaissance indicators early and logged a number of IP addresses linked to the actor, together with these originating from Egypt and Mullvad VPN companies.
Resecurity stated it responded by deploying a “honeypot” account inside an remoted atmosphere that allowed the menace actor to log in and work together with methods containing pretend worker, buyer, and fee information whereas it was being monitored by the researchers.
A honeypot is a intentionally uncovered, monitored system or account designed to lure attackers, permitting them to be noticed and analyzed and to collect intelligence on their exercise with out risking actual information or infrastructure.
The corporate says it populated the honeypot with artificial datasets designed to carefully resemble real-world enterprise information. These included greater than 28,000 artificial client information and over 190,000 artificial fee transaction information, each generated from Stripe’s official API format.
In keeping with Resecurity, the menace actor started trying to automate information exfiltration in December, producing greater than 188,000 requests between December 12 and December 24 whereas utilizing massive numbers of residential proxy IP addresses.
Throughout this exercise, the corporate says it collected telemetry on the attacker’s ways, methods, and infrastructure.
Supply: Resecurity
Resecurity claims that the attacker briefly uncovered confirmed IP addresses on a number of events resulting from proxy connection failures, and that the intel was reported to legislation enforcement.
After observing further exercise, Resecurity says it added additional pretend datasets to check the attacker’s conduct, which led to further OPSEC failures and helped slender down the menace actor’s infrastructure.
The agency says it later recognized servers used to automate the assault by way of residential proxies and shared the intelligence with legislation enforcement as properly.
“As soon as the actor was positioned utilizing accessible community intelligence and timestamps, a overseas legislation enforcement group, a accomplice of Resecurity, issued a subpoena request relating to the menace actor,” says Resecurity.
On the time of writing, ShinyHunters has not offered any additional proof, solely issuing a brand new Telegram put up stating that extra data can be coming quickly.
“Good injury management Resecurity. Extra data coming quickly!,” posted the menace actors.
Whether or not you are cleansing up previous keys or setting guardrails for AI-generated code, this information helps your workforce construct securely from the beginning.
Get the cheat sheet and take the guesswork out of secrets and techniques administration.
