A prolific cybercriminal group that calls itself \u201cScattered LAPSUS$ Hunters<\/strong>\u201d has dominated headlines this 12 months by frequently stealing knowledge from and publicly mass extorting dozens of main companies. However the tables appear to have turned considerably for \u201cRey,\u201d the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his actual life identification and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father.<\/p>\n

Scattered LAPSUS$ Hunters (SLSH) is regarded as an amalgamation of three hacking teams \u2014 Scattered Spider<\/strong><\/a>, LAPSUS$<\/strong><\/a> and ShinyHunters<\/strong><\/a>. Members of those gangs hail from most of the similar chat channels on the Com<\/strong>, a largely English-language cybercriminal group that operates throughout an ocean of Telegram and Discord servers.<\/p>\n

In Could 2025, SLSH members launched a social engineering marketing campaign<\/a> that used voice phishing to trick targets into connecting a malicious app to their group\u2019s Salesforce portal. The group later launched a knowledge leak portal that threatened to publish the interior knowledge of three dozen corporations that allegedly had Salesforce knowledge stolen, together with Toyota<\/strong>,\u00a0FedEx<\/strong>,\u00a0Disney\/Hulu<\/strong>, and\u00a0UPS<\/strong>.<\/p>\n

$\"\"$ <\/p>\n
The brand new extortion web site tied to ShinyHunters, which threatens to publish stolen knowledge until Salesforce or particular person sufferer corporations conform to pay a ransom.<\/p>\n<\/div>\n
Final week, the SLSH Telegram channel featured a suggestion to recruit and reward \u201cinsiders,\u201d staff at giant corporations who conform to share inner entry to their employer\u2019s community for a share of no matter ransom fee is in the end paid by the sufferer firm.<\/p>\n
SLSH has solicited insider entry beforehand, however their newest name for disgruntled staff began making the rounds on social media on the similar time information broke that the cybersecurity agency Crowdstrike<\/strong> had fired an worker for allegedly sharing screenshots of inner methods<\/a> with the hacker group (Crowdstrike stated their methods have been by no means compromised and that it has turned the matter over to legislation enforcement companies).<\/p>\n
$\"\"$ <\/p>\n
The Telegram server for the Scattered LAPSUS$ Hunters has been trying to recruit insiders at giant corporations.<\/p>\n<\/div>\n
Members of SLSH have historically used different ransomware gangs\u2019 encryptors in assaults, together with malware from ransomware affiliate applications like ALPHV\/BlackCat, Qilin, RansomHub, and DragonForce. However final week, SLSH introduced on its Telegram channel the discharge of their very own ransomware-as-a-service operation<\/a> known as ShinySp1d3r<\/strong>.<\/p>\n
The person chargeable for releasing the ShinySp1d3r ransomware providing is a core SLSH member who goes by the deal with \u201cRey\u201d and who’s presently one among simply three directors of the SLSH Telegram channel. Beforehand, Rey was an administrator<\/a> of the info leak web site for Hellcat<\/strong>, a ransomware group that surfaced in late 2024 and was concerned in assaults on corporations together with Schneider Electrical<\/strong>, Telefonica<\/strong>, and Orange Romania<\/strong>.<\/p>\n
$\"\"$ <\/p>\n
A latest, barely redacted screenshot of the Scattered LAPSUS$ Hunters Telegram channel description, exhibiting Rey as one among three directors.<\/p>\n<\/div>\n
Additionally in 2024, Rey would take over as administrator of the most up-to-date incarnation of BreachForums<\/a>, an English-language cybercrime discussion board whose domains have been seized on a number of events by the FBI and\/or by worldwide authorities. In April 2025, Rey posted on Twitter\/X<\/a> about one other FBI seizure of BreachForums.<\/p>\n
On October 5, 2025, the FBI introduced<\/a> it had as soon as once more seized the domains related to BreachForums, which it described as a significant legal market utilized by ShinyHunters and others to visitors in stolen knowledge and facilitate extortion.<\/p>\n
\u201cThis takedown removes entry to a key hub utilized by these actors to monetize intrusions, recruit collaborators, and goal victims throughout a number of sectors,\u201d the FBI stated.<\/p>\n
Extremely, Rey would make a sequence of crucial operational safety errors final 12 months that offered a number of avenues to establish and ensure his real-life identification and site. Learn on to be taught the way it all unraveled for Rey.<\/p>\n
WHO IS REY?<\/h2>\n
In keeping with the cyber intelligence agency Intel 471<\/strong>, Rey was an energetic consumer on varied BreachForums<\/strong> reincarnations over the previous two years, authoring greater than 200 posts between February 2024 and July 2025. Intel 471 says Rey beforehand used the deal with \u201cHikki-Chan<\/strong>\u201d on BreachForums, the place their first publish shared knowledge allegedly stolen from the U.S. Facilities for Illness Management and Prevention<\/strong> (CDC).<\/p>\n
In that February 2024 publish concerning the CDC, Hikki-Chan says they may very well be reached on the Telegram username @wristmug<\/strong>. In Could 2024, @wristmug posted in a Telegram group chat known as \u201cPantifan\u201d a replica of an extortion e-mail they stated they obtained that included their e-mail deal with and password.<\/p>\n
The message that @wristmug lower and pasted seems to have been a part of an automated e-mail rip-off<\/a> that claims it was despatched by a hacker who has compromised your pc and used your webcam to file a video of you when you have been watching porn. These missives threaten to launch the video to all of your contacts until you pay a Bitcoin ransom, they usually usually reference an actual password the recipient has used beforehand.<\/p>\n
\u201cNoooooo,\u201d the @wristmug account wrote in mock horror after posting a screenshot of the rip-off message. \u201cI have to be achieved guys.\u201d<\/p>\n
$\"\"$ <\/p>\n
A message posted to Telegram by Rey\/@wristmug.<\/p>\n<\/div>\n
In posting their screenshot, @wristmug redacted the username portion of the e-mail deal with referenced within the physique of the rip-off message. Nonetheless, they didn’t redact their previously-used password, they usually left the area portion of their e-mail deal with (@proton.me) seen within the screenshot.<\/p>\n
O5TDEV<\/h2>\n
Looking out on @wristmug\u2019s slightly distinctive 15-character password within the breach monitoring service Spycloud<\/strong> finds it’s recognized to have been utilized by only one e-mail deal with: cybero5tdev@proton.me<\/strong>. In keeping with Spycloud, these credentials have been uncovered at the least twice in early 2024 when this consumer\u2019s machine was contaminated with an infostealer trojan that siphoned all of its saved usernames, passwords and authentication cookies (a discovering that was initially revealed<\/a> in March 2025 by the cyber intelligence agency KELA<\/strong>).<\/p>\n
Intel 471 exhibits the e-mail deal with cybero5tdev@proton.me belonged to a BreachForums member who glided by the username o5tdev<\/strong>. Looking out on this nickname in Google brings up at the least two web site defacement archives exhibiting {that a} consumer named o5tdev was beforehand concerned in defacing websites with pro-Palestinian messages<\/a>. The screenshot beneath, for instance, exhibits that 05tdev was a part of a bunch known as Cyb3r Drag0nz Crew<\/strong>.<\/p>\n
$\"\"$ <\/p>\n
Rey\/o5tdev\u2019s defacement pages. Picture: archive.org.<\/p>\n<\/div>\n
A 2023 report from SentinelOne<\/strong> described Cyb3r Drag0nz Crew as a hacktivist group with a historical past of launching DDoS assaults and cyber defacements in addition to participating in knowledge leak exercise.<\/p>\n
\u201cCyb3r Drag0nz Crew claims to have leaked knowledge on over 1,000,000 of Israeli residents unfold throughout a number of leaks,\u201d SentinelOne reported<\/a>. \u201cSo far, the group has launched a number of .RAR archives of purported private data on residents throughout Israel.\u201d<\/p>\n
The cyber intelligence agency Flashpoint<\/strong> finds the Telegram consumer @05tdev was energetic in 2023 and early 2024, posting in Arabic on anti-Israel channels like \u201cGhost of Palestine\u201d [full disclosure: Flashpoint is currently an advertiser on this blog].<\/p>\n
\u2018I\u2019M A GINTY\u2019<\/h2>\n
Flashpoint exhibits that Rey\u2019s Telegram account (ID7047194296) was notably energetic in a cybercrime-focused channel known as Jacuzzi<\/strong>, the place this consumer shared a number of private particulars, together with that their father was an airline pilot. Rey claimed in 2024 to be 15 years outdated, and to have household connections to Eire.<\/p>\n
Particularly, Rey talked about in a number of Telegram chats that he had Irish heritage, even posting a graphic that exhibits the prevalence of the surname \u201cGinty<\/strong>.\u201d<\/p>\n
$\"\"$ <\/p>\n
Rey, on Telegram claiming to have affiliation to the surname \u201cGinty.\u201d Picture: Flashpoint.<\/p>\n<\/div>\n
Spycloud listed tons of of credentials stolen from cybero5dev@proton.me, and people particulars point out that Rey\u2019s pc is a shared Microsoft Home windows machine positioned in Amman, Jordan. The credential knowledge stolen from Rey in early 2024 present there are a number of customers of the contaminated PC, however that every one shared the identical final title of Khader and an deal with in Amman, Jordan.<\/p>\n
The \u201cautofill\u201d knowledge lifted from Rey\u2019s household PC incorporates an entry for a 46-year-old Zaid Khader<\/strong> that claims his mom\u2019s maiden title was Ginty. The infostealer knowledge additionally exhibits Zaid Khader continuously accessed inner web sites for workers of Royal Jordanian Airways<\/strong>.<\/p>\n
MEET SAIF<\/h2>\n
The infostealer knowledge makes clear that Rey\u2019s full title is Saif Al-Din Khader<\/strong>. Having no luck contacting Saif instantly, KrebsOnSecurity despatched an e-mail to his father Zaid. The message invited the daddy to reply by way of e-mail, cellphone or Sign, explaining that his son gave the impression to be deeply enmeshed in a critical cybercrime conspiracy.<\/p>\n
Lower than two hours later, I obtained a Sign message from Saif, who stated his dad suspected the e-mail was a rip-off and had forwarded it to him.<\/p>\n
\u201cI noticed your e-mail, sadly I don\u2019t assume my dad would reply to this as a result of they assume its some \u2018rip-off e-mail,’\u201d stated Saif, who informed me he turns 16 years outdated subsequent month. \u201cSo I made a decision to speak to you instantly.\u201d<\/p>\n
Saif defined that he\u2019d already heard from European legislation enforcement officers, and had been making an attempt to extricate himself from SLSH. When requested why then he was concerned in releasing SLSH\u2019s new ShinySp1d3r ransomware-as-a-service providing, Saif stated he couldn\u2019t simply instantly stop the group.<\/p>\n
\u201cEffectively I cant simply dip like that, I\u2019m making an attempt to scrub up the whole lot I\u2019m related to and transfer on,\u201d he stated.<\/p>\n
$\"\"$ <\/p>\n
The previous Hellcat ransomware website. Picture: Kelacyber.com<\/p>\n<\/div>\n
He additionally shared that ShinySp1d3r is only a rehash of Hellcat ransomware, besides modified with AI instruments. \u201cI gave the supply code of Hellcat ransomware out principally.\u201d<\/p>\n
Saif claims he reached out on his personal lately to the Telegram account for Operation Endgame,<\/strong> the codename for an ongoing legislation enforcement operation concentrating on cybercrime companies, distributors and their clients<\/a>.<\/p>\n
\u201cI\u2019m already cooperating with legislation enforcement,\u201d Saif stated. \u201cThe truth is, I’ve been speaking to them since at the least June. I’ve informed them almost the whole lot. I haven\u2019t actually achieved something like breaching right into a corp or extortion associated since September.\u201d<\/p>\n
Saif steered {that a} story about him proper now might endanger any additional cooperation he could possibly present. He additionally stated he wasn\u2019t certain if the U.S. or European authorities had been in touch with the Jordanian authorities about his involvement with the hacking group.<\/p>\n
\u201cA narrative would deliver a lot undesirable warmth and would make issues very tough if I\u2019m going to cooperate,\u201d Saif stated. \u201cI\u2019m not sure whats going to occur they stated they\u2019re in touch with a number of international locations relating to my request however its been like a complete week and I obtained no updates from them.\u201d<\/p>\n
Saif shared a screenshot that indicated he\u2019d contacted Europol authorities late final month. However he couldn\u2019t title any legislation enforcement officers he stated have been responding to his inquiries, and KrebsOnSecurity was unable to confirm his claims.<\/p>\n
\u201cI don\u2019t actually care I simply need to transfer on from all these things even when its going to be jail time or no matter they gonna say,\u201d Saif stated.<\/p>\n<\/p><\/div>\n
<\/script>
\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
A prolific cybercriminal group that calls itself \u201cScattered LAPSUS$ Hunters\u201d has dominated headlines this 12 months by frequently stealing knowledge from and publicly mass extorting dozens of main companies. However the tables appear to have turned considerably for \u201cRey,\u201d the moniker chosen by the technical operator and public face of the hacker group: Earlier this […]<\/p>\n","protected":false},"author":2,"featured_media":9186,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[895,5712,262,5711,2072,6640,2075,211],"class_list":["post-9184","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-admin","tag-hunters","tag-krebs","tag-lapsus","tag-meet","tag-rey","tag-scattered","tag-security"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/9184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9184"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/9184\/revisions"}],"predecessor-version":[{"id":9185,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/9184\/revisions\/9185"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/9186"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}