You once presented a unified front with ShinyHunters under the Scattered LAPSUS$ Hunters, but now you seem to be running separate brands and leak sites again - what happened inside that alliance, and why the split

We have never been allied with ShinyHunters. In reality, they are no longer what they originally were. James simply took it over from Hei. Today, they are mostly impostors trying to exploit a name that no longer belongs to them

Researchers say TeamPCP shifted from rapidly compromising tools like Trivy, LiteLLM, and Telnyx to a monetization phase, collaborating with LAPSUS$, ShinyHunters, and others - how did that partnership actually work

Initially, the collaboration was only between LAPSUS$ and TeamPCP. Later on, they also started working with Vect, which ended up having its collected data stolen by actors impersonating ShinyHunters. As for our collaboration with TeamPCP, it was structured: we obtained access, they handled the technical deployment aspects, and we are now focused on exploitation. Several targets have already been impacted, and more will follow

TeamPCP turned trusted tools like Trivy, LiteLLM, and Telnyx into delivery vectors, poisoning developers' own pipelines - from inside that collaboration, what did you learn about how fragile the software supply chain really is, and how much further could you have pushed it if you wanted

Yes, it's clear that the impact could have been much greater if the tools had been more refined before deployment. That would have allowed for much wider propagation. However, that part was not under our control. Since then, with TeamPCP, we have reorganized our internal infrastructure to prevent this type of situation from happening again

The Rockstar and GTA 6 breach is pinned on Arion Kurtaj, now under an indefinite secure hospital order - how central was he to LAPSUS$, and how did his arrest and detention change the way the rest of the group operates

We cannot answer this question

The FBI put LAPSUS$ on its radar, City of London Police arrested seven teenagers in March 2022, and Brazilian Federal Police launched Operation Dark Cloud with further arrests - which of those moves actually hurt your operations, and where do you think law enforcement still misunderstands how your group is structured

Every arrest inevitably impacts operations. That is exactly what led to a prolonged period of inactivity. But now we are back. What comes next will speak for itself

You became known for recruiting insiders in the open, offering big weekly payouts for VPN and MFA access - how do you decide whom to trust now, and how real is the fear that one of those insiders is actually an informant

We only trust individuals who can concretely prove that they are real insiders. The risk of infiltration always exists, but it is not something that truly affects our decisions or concerns us, we are a fairly closed group

Across campaigns against targets like Microsoft, Okta, Uber, and large SaaS platforms, which social-engineering techniques, MFA fatigue, SIM swaps, vishing, etc., turned out to be your most reliable way in, and what keeps making employees fall for them

The most effective methods for a long time were MFA and SIM swapping. Today, we rely more on insiders as well as calling techniques. With access to certain data obtained from supply chain attacks, our approach is now more technical

With key figures detained or arrested but new alliances with ShinyHunters, Scattered Spider and now TeamPCP, how do you see LAPSUS$ evolving over the next 2 years, and what, if anything, would actually make you stop

Our evolution will continue in the same direction: visibility, impact, and collaborations, especially with TeamPCP. We will continue to expose and extort companies. The only thing that could truly stop us would be a complete change in mindset, which remains unlikely

What inspired you to choose this path, and what led you into the world of cyber attacks in the first place

Money and enjoyment, simply

Are you using AI in your operations, and if so, how is it helping you during attacks

We barely use AI in our operations, only to structure and sort the data we collect

Is there any final message you would like to share with my 40k followers

Insiders and buyers are welcome. Visit our website and contact us via Session