Scattered Lapsus$ Hunters

Scattered Lapsus$ Hunters, sometimes referred to as UNC6040 and UNC6395,^[1][2] is a cybercrime supergroup also known and referred to as "Trinity of Chaos"^[3]. The supergroup is an international extortion-focused collective or alliance. They first appeared in or around August 2025,^[4] and have claimed responsibility for several notable data breaches, including but not limited to; those of stealing over 1 billion customer records from Salesforce from both their UNC6040^[5] and UNC6395^[6] campaigns,^[7][8][9] RedHat^[10] and the doxing ICE officials.^[11] Their website BreachForums was seized by the US and French police forces in October 2025 following the public extortions against Salesforce.^[12] The supergroup claimed on their Telegram channel to be formed from members of other groups like Scattered Spider, Lapsus$ and ShinyHunters.^[4]

Scattered LAPSUS$ Hunters

Named after	Collation of ShinyHunters, Scattered Spider, and Lapsus$
Formation	2025
Founder	ShinyHunters
Type	Cybercrime gang
Methods	Spearphishing, SIM swapping, recruitment of accomplices via social media, extortion, hacking, Social engineering (security), Ransomware
Membership	Over 10 (suspected to be more)
Official language	English, French
ShinyHunters	ShinyCorp
Parent organization	ShinyHunters
Affiliations	ShinyHunters, Scattered Spider, and Lapsus$