Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 03-Oct-2025 22:13:57 JST Kevin Beaumont

   Not sure the LAPSUS$ ransomware portal is really them, given they managed to write sentences that make sense and didn’t include an anime girl pooing on Red Reddington or some such. https://social.circl.lu/@Ransomlook/115310385984277849

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 03-Oct-2025 22:27:50 JST Kevin Beaumont

     in reply to

     • :mastodon: decio

     Actually may be them, check out the source. HT @decio

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 04-Oct-2025 00:10:42 JST Kevin Beaumont

     in reply to

     The Scattered Lapsus$ Hunters portal has 25 victim orgs posted so far, they're an average of about one every 10 minutes.

     I've talked to one of the victim orgs - their sample data is indeed from their Salesforce instance. Gonna be a long weekend for a bunch of orgs. Each org also has sample downloads up too.

     #threatintel

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 04-Oct-2025 00:20:31 JST Kevin Beaumont

     in reply to

     Also they've hidden 4 minutes of music on their webserver - /m_1701h87271.mp3

     I don't know what it is but here's my reaction

   • Embed this notice
     Paul Shread (pshread@masto.ai)'s status on Saturday, 04-Oct-2025 00:25:11 JST Paul Shread

     in reply to

     @GossiTheDog I think that's just the Salesloft data on their new data leak site

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 04-Oct-2025 00:33:05 JST Kevin Beaumont

     in reply to

     This is the music on the LAPSUS portal HT @Rairii

     https://www.youtube.com/watch?v=ICGCjCn62SY

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 04-Oct-2025 01:11:48 JST Kevin Beaumont

     in reply to

     For anybody following the LAPSUS$ weekend saga - they're staging data into /samples on their Tor server before posting, there's 39 orgs so far, many aren't announced yet - e.g. Cisco

     The data is authentic, and there's quite a lot.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 04-Oct-2025 01:14:17 JST Kevin Beaumont

     in reply to

     Some of it is PII, too - e.g. TransUnion credit agency is there with live chat transcripts with customers.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 04-Oct-2025 01:20:33 JST Kevin Beaumont

     in reply to

     when i scoop the extortion group

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 04-Oct-2025 01:38:34 JST Kevin Beaumont

     in reply to

     Just for any confusion, this data appears to be via Salesforce and Salesloft Drift a few months ago. Lots of the victim orgs didn't disclose a breach but, well, probably knew.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 06-Oct-2025 06:48:45 JST Kevin Beaumont

     in reply to

     The LAPSUS$ guys are claiming Red Hat, CIC Vietnam and S&P Global. The Red Hat one is their Gitlab breach. #threatintel

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 06-Oct-2025 20:45:56 JST Kevin Beaumont

     in reply to

     This is the data LAPSUS$ claims to have on S&P Global (Standard and Poor's), via their portal.

     "- 32,795,309+ emails
     - 164,892,402+ persons records (minimum containing full name and position)
     - 936,731,849+ company records
     - 3,121,823,085+ panjiva shipping records
     - Latest data is from Feb 2025"

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 06-Oct-2025 22:47:11 JST Kevin Beaumont

     in reply to

     LAPSUS$ also has CIC (Credit Institute of Vietnam, owned by Bank of Vietnam) on their portal.

     Previous media reporting had them disclosing a breach in September.

     The sample database has 2,766,581,210 lines

     #threatintel

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 09-Oct-2025 22:12:14 JST Kevin Beaumont

     in reply to

     The Scattered Spider Lapsus$ ShinyHunters Crimson Collective Fleetwood Mac APT Teen Supergroup say they plan to dump Salesforce data tomorrow at 11:59 East Coast US time (5am UTC on Saturday).

     I'm rooting for Salesforce not paying, as it sends a message this cycle needs to stop.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 09-Oct-2025 22:16:07 JST Kevin Beaumont

     in reply to

     • Wendy Nather

     @wendynather 'gonna get v& and then a job at Mandiant managing the people who tracked them' coming soon

   • Embed this notice
     Wendy Nather (wendynather@infosec.exchange)'s status on Thursday, 09-Oct-2025 22:16:08 JST Wendy Nather

     in reply to

     @GossiTheDog But have they dropped their new album yet?

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 17-Oct-2025 18:26:24 JST Kevin Beaumont

     in reply to

     Although the Scattered Spider Lapsus$ ShinyHunters Crimson Collective Fleetwood Mac APT Teen Supergroup portal has a message up saying they're disbanding for the past few days, I don't think it's law enforcement - it appears to just be the group.

     For one thing the downloads are still online on the same server.