Replace: Article up to date to mirror that the ShinyHunters says they weren’t concerned on this exercise. We now have up to date our story and title.
Risk actors related to the “Scattered Lapsus$ Hunters” (SLH) declare to have breached the techniques of cybersecurity agency Resecurity and stolen inside knowledge, whereas Resecurity says the attackers solely accessed a intentionally deployed honeypot containing faux data used to watch their exercise.
At present, menace actors revealed screenshots on Telegram of the alleged breach, claiming they stole worker knowledge, inside communications, menace intelligence reviews, and shopper data.
“We want to announce that we have now gained full entry to REsecurity techniques,” the group wrote on Telegram, claiming to have stolen “all inside chats and logs”, “full worker knowledge”, “menace intel associated reviews”, and a “full shopper listing with particulars.”
Supply: BleepingComputer
As proof of their claims, the menace actors revealed screenshots they allege had been stolen from Resecurity, together with what seems to be a Mattermost collaboration occasion displaying communications between Resecurity workers and Pastebin personnel concerning malicious content material hosted on the text-sharing platform.
The menace actors, who discuss with themselves as “Scattered Lapsus$ Hunters” as a result of alleged overlap between ShinyHunters, Lapsus$, and Scattered Spider menace actors, stated the assault was retaliation for what they declare are ongoing makes an attempt by Resecurity to socially engineer the group and be taught extra about its operations.
The menace actors say Resecurity workers pretended to be patrons throughout the sale of an alleged Vietnam monetary system database, in search of free samples and extra data.
After publishing this text, the ShinyHunters spokesperson instructed BleepingComputer that they weren’t concerned on this exercise. Whereas ShinyHunters has at all times claimed to be a part of Scattered Lapsus$ Hunters, they state they weren’t concerned on this assault.
We now have up to date our article with this data.
When you’ve got any data concerning this incident or different undisclosed assaults, you may contact us confidentially through Sign at 646-961-3731 or at ideas@bleepingcomputer.com.
Resecurity says it was a honeypot
Resecurity disputes the menace actor’s claims, stating that the allegedly breached techniques aren’t a part of its respectable manufacturing infrastructure however had been as an alternative a honeypot designed to draw and monitor the menace actors.
After BleepingComputer contacted Resecurity in regards to the declare, they shared a report revealed on December 24, the place the corporate says it first detected a menace actor probing their publicly uncovered techniques on November 21, 2025.
The corporate says its DFIR crew recognized reconnaissance indicators early and logged a number of IP addresses linked to the actor, together with these originating from Egypt and Mullvad VPN providers.
Resecurity stated it responded by deploying a “honeypot” account inside an remoted setting that allowed the menace actor to log in and work together with techniques containing faux worker, buyer, and fee knowledge whereas it was being monitored by the researchers.
A honeypot is a intentionally uncovered, monitored system or account designed to lure attackers, permitting them to be noticed and analyzed and to assemble intelligence on their exercise with out risking actual knowledge or infrastructure.
The corporate says it populated the honeypot with artificial datasets designed to carefully resemble real-world enterprise knowledge. These included greater than 28,000 artificial shopper data and over 190,000 artificial fee transaction data, each generated from Stripe’s official API format.
In response to Resecurity, the menace actor started making an attempt to automate knowledge exfiltration in December, producing greater than 188,000 requests between December 12 and December 24 whereas utilizing massive numbers of residential proxy IP addresses.
Throughout this exercise, the corporate says it collected telemetry on the attacker’s techniques, methods, and infrastructure.
Supply: Resecurity
Resecurity claims that the attacker briefly uncovered confirmed IP addresses on a number of events on account of proxy connection failures, and that the intel was reported to legislation enforcement.
After observing further exercise, Resecurity says it added additional faux datasets to check the attacker’s conduct, which led to further OPSEC failures and helped slender down the menace actor’s infrastructure.
The agency says it later recognized servers used to automate the assault through residential proxies and shared the intelligence with legislation enforcement as nicely.
“As soon as the actor was positioned utilizing accessible community intelligence and timestamps, a international legislation enforcement group, a accomplice of Resecurity, issued a subpoena request concerning the menace actor,” says Resecurity.
On the time of writing, the menace actors haven’t supplied any additional proof, solely issuing a brand new Telegram put up stating that extra data will probably be coming quickly.
“Good harm management Resecurity. Extra data coming quickly!,” reads a put up on Telegram.
As MCP (Mannequin Context Protocol) turns into the usual for connecting LLMs to instruments and knowledge, safety groups are shifting quick to maintain these new providers secure.
This free cheat sheet outlines 7 greatest practices you can begin utilizing at present.
