A new cybercrime alliance calling itself Scattered Lapsus$ Hunters, also referenced in underground channels as SP1D3R HUNTERS or SLSH, has launched an aggressive extortion campaign targeting corporate Salesforce tenants globally.
The group, which security researchers link to the so‑called “Trinity of Chaos” composed of Muddled Libra (Scattered Spider), Bling Libra (ShinyHunters), and LAPSUS$, claims to have stolen over one billion Salesforce records between May and September 2025.
The stolen data allegedly spans dozens of high-profile organizations across the retail, technology, and logistics sectors, including Toyota, FedEx, Disney/Hulu, and UPS.
Bling Libra’s Extortion-as-a-Service Model
The group’s extortion portal, hosted temporarily on an infrastructure tied to BreachForums, appeared online on October 3 under the name “Scattered Lapsus$ Hunters DLS.”
On that site, the syndicate listed 39 corporate victims and issued an October 10 deadline for ransom payments before releasing data publicly.
According to telemetry from Palo Alto Networks’ Unit 42, Bling Libra, the ShinyHunters faction, has positioned itself as an extortion-as-a-service (EaaS) provider, collaborating with affiliates who share a 25–30% cut of ransom earnings.
Unlike ransomware-as-a-service (RaaS) operations that deploy encryption payloads, EaaS relies solely on data theft, allowing attackers to operate more covertly and avoid many of the law enforcement crackdowns that crippled past ransomware networks.
Voice phishing (vishing) remains a central tactic for these campaigns. Victims were deceived into authorizing malicious OAuth integrations within their Salesforce portals, enabling attackers to exfiltrate sensitive customer data and authentication tokens.
Google Threat Intelligence attributed parts of this operation to UNC6040 and UNC6395, clusters overlapping with previous ShinyHunters and Scattered Spider activity.
The group’s infrastructure briefly hosted exploit scripts for a separate vulnerability, CVE‑2025‑61882, a zero‑day remote code execution flaw in Oracle E‑Business Suite, which was exploited in parallel with extortion efforts.
Expanding Collaborations and Persistent Risks
Adding to the threat landscape, Bling Libra appears to have entered an operational partnership with Crimson Collective, a newer extortion group that recently breached Red Hat’s internal GitLab server, stealing 570 GB of source code and more than 800 Customer Engagement Reports containing client audit details and cloud infrastructure data.
Both groups have used shared Telegram channels and mirrored posts on underground forums to coordinate their disclosures and synchronize extortion messaging.
While the FBI successfully seized BreachForums’ infrastructure and associated clearnet domains tied to the Salesforce extortion campaign on October 9, Bling Libra asserts that its darknet infrastructure remains active and its members are not compromised.
The conglomerate threatened to release data at “11:59 PM New York time on 10/10/2025.”
Security experts caution that this campaign marks a shift from traditional ransomware schemes to data-centric EaaS monetization.
Organizations using Salesforce, AWS, or similar SaaS ecosystems have been urged to adopt zero-trust access controls, continuously scan for exposed credentials through tools like TruffleHog, and join sectoral ISACs for rapid threat intelligence sharing.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
