Scattered Lapsus$ Hunters
Cybercrime group
From Wikipedia, the free encyclopedia
Scattered Lapsus$ Hunters, sometimes referred to as UNC6040 and UNC6395,[1][2] is a cybercrime supergroup also known and referred to as "Trinity of Chaos".[3] The supergroup is an international extortion-focused collective or alliance. They first appeared in or around August 2025,[4] and have claimed responsibility for several notable data breaches, including but not limited to; stealing over 1 billion customer records from Salesforce from both their UNC6040[5] and UNC6395[6] campaigns,[7][8][9] RedHat[10] and doxxing ICE officials.[11] Their website BreachForums was seized by the US and French police forces in October 2025 following the public extortions against Salesforce.[12] The supergroup claimed on their Telegram channel to be formed from members of other groups like Scattered Spider, Lapsus$ and ShinyHunters.[4]
| Named after | Collation of ShinyHunters, Scattered Spider, and Lapsus$ |
|---|---|
| Formation | 2025 |
| Founder | ShinyHunters |
| Type | Cybercrime gang |
| Methods | Spearphishing, SIM swapping, recruitment of accomplices via social media, extortion, hacking, Social engineering (security), Ransomware |
| Membership | Over 10 (suspected to be more) |
Official language | English, French |
| ShinyCorp | |
Parent organization | ShinyHunters |
| Affiliations | ShinyHunters, Scattered Spider, and Lapsus$ |