Replace: Article up to date to mirror that the ShinyHunters says they weren’t concerned on this exercise. We’ve up to date our story and title.
Menace actors related to the “Scattered Lapsus$ Hunters” (SLH) declare to have breached the programs of cybersecurity agency Resecurity and stolen inner knowledge, whereas Resecurity says the attackers solely accessed a intentionally deployed honeypot containing faux info used to watch their exercise.
Right now, menace actors revealed screenshots on Telegram of the alleged breach, claiming they stole worker knowledge, inner communications, menace intelligence stories, and shopper info.
“We want to announce that we’ve got gained full entry to REsecurity programs,” the group wrote on Telegram, claiming to have stolen “all inner chats and logs”, “full worker knowledge”, “menace intel associated stories”, and a “full shopper listing with particulars.”
Supply: BleepingComputer
As proof of their claims, the menace actors revealed screenshots they allege have been stolen from Resecurity, together with what seems to be a Mattermost collaboration occasion exhibiting communications between Resecurity staff and Pastebin personnel concerning malicious content material hosted on the text-sharing platform.
The menace actors, who confer with themselves as “Scattered Lapsus$ Hunters” as a result of alleged overlap between ShinyHunters, Lapsus$, and Scattered Spider menace actors, stated the assault was retaliation for what they declare are ongoing makes an attempt by Resecurity to socially engineer the group and be taught extra about its operations.
The menace actors say Resecurity staff pretended to be consumers through the sale of an alleged Vietnam monetary system database, searching for free samples and extra info.
After publishing this text, the ShinyHunters spokesperson advised BleepingComputer that they weren’t concerned on this exercise. Whereas ShinyHunters has at all times claimed to be a part of Scattered Lapsus$ Hunters, they state they weren’t concerned on this assault.
We’ve up to date our article with this info.
When you’ve got any info concerning this incident or different undisclosed assaults, you’ll be able to contact us confidentially by way of Sign at 646-961-3731 or at ideas@bleepingcomputer.com.
Resecurity says it was a honeypot
Resecurity disputes the menace actor’s claims, stating that the allegedly breached programs should not a part of its official manufacturing infrastructure however have been as an alternative a honeypot designed to draw and monitor the menace actors.
After BleepingComputer contacted Resecurity concerning the declare, they shared a report revealed on December 24, the place the corporate says it first detected a menace actor probing their publicly uncovered programs on November 21, 2025.
The corporate says its DFIR workforce recognized reconnaissance indicators early and logged a number of IP addresses linked to the actor, together with these originating from Egypt and Mullvad VPN providers.
Resecurity stated it responded by deploying a “honeypot” account inside an remoted atmosphere that allowed the menace actor to log in and work together with programs containing faux worker, buyer, and cost knowledge whereas it was being monitored by the researchers.
A honeypot is a intentionally uncovered, monitored system or account designed to lure attackers, permitting them to be noticed and analyzed and to collect intelligence on their exercise with out risking actual knowledge or infrastructure.
The corporate says it populated the honeypot with artificial datasets designed to carefully resemble real-world enterprise knowledge. These included greater than 28,000 artificial client data and over 190,000 artificial cost transaction data, each generated from Stripe’s official API format.
In response to Resecurity, the menace actor started making an attempt to automate knowledge exfiltration in December, producing greater than 188,000 requests between December 12 and December 24 whereas utilizing giant numbers of residential proxy IP addresses.
Throughout this exercise, the corporate says it collected telemetry on the attacker’s ways, strategies, and infrastructure.
Supply: Resecurity
Resecurity claims that the attacker briefly uncovered confirmed IP addresses on a number of events resulting from proxy connection failures, and that the intel was reported to regulation enforcement.
After observing further exercise, Resecurity says it added additional faux datasets to check the attacker’s habits, which led to further OPSEC failures and helped slender down the menace actor’s infrastructure.
The agency says it later recognized servers used to automate the assault by way of residential proxies and shared the intelligence with regulation enforcement as properly.
“As soon as the actor was situated utilizing accessible community intelligence and timestamps, a international regulation enforcement group, a accomplice of Resecurity, issued a subpoena request concerning the menace actor,” says Resecurity.
On the time of writing, the menace actors haven’t supplied any additional proof, solely issuing a brand new Telegram put up stating that extra info might be coming quickly.
“Good injury management Resecurity. Extra info coming quickly!,” reads a put up on Telegram.
Whether or not you are cleansing up previous keys or setting guardrails for AI-generated code, this information helps your workforce construct securely from the beginning.
Get the cheat sheet and take the guesswork out of secrets and techniques administration.
