This has not been a great week for hackers whose claims have been refuted. First, ScatteredLapsus$Hunters' claim about Resecurity was refuted , and now claims b

It may be a bit of an understatement to say that Resecurity has been up in the faces of ScatteredLapsus$Hunters and ShinyHunters.  Not only did they recently em

This has not been a great week for hackers whose claims have been refuted. First, ScatteredLapsus$Hunters' claim about Resecurity was refuted , and now claims b

ScatteredLapsus$Hunters (SLH) welcomed the new year by announcing that they had hacked Resecurity and taken "everything," including: – All internal chats and lo

Resecurity, a cybersecurity firm specializing in threat intelligence, has released data on John Erin Binns, also known as IRDev, a threat actor associated with groups such as ScatteredLapsus$Hunters and ShinyHunters. Previously, Resecurity successfully deployed a honeypot to gather intelligence on ScatteredLapsus$Hunters, providing law enforcement with details on an attempt to access synthetic data. The recent disclosure sheds light on Binns' activities, although specific technical details, exact dates, and concrete impact are not provided in the article. This information could potentially enhance the cybersecurity community's understanding of the tactics, techniques, and procedures (TTPs) employed by these threat actors. However, the lack of detailed technical information limits the immediate operational value of the disclosure. The collaboration between private cybersecurity firms and law enforcement is crucial for effective cyber crime prevention and prosecution. Cybersecurity professionals should remain vigilant and continue to monitor developments related to these threat actors to enhance their defensive strategies.

On January 6, 2026, a malicious actor using the pseudonym "1011" claimed to have compromised NordVPN through a brute-force attack. NordVPN has firmly denied these allegations, although they have not provided additional technical details about their security measures. This incident is part of a series of similar false claims, including a previous denial against the group "ScatteredLapsus$Hunters" regarding Resecurity. Importantly, there is no evidence of any breach, data leak, or concrete impact reported in the article. Brute-force attacks are a common method where attackers systematically check all possible passwords to gain access. If the claim were true, it would suggest potential vulnerabilities in NordVPN's security measures. However, given the lack of evidence and NordVPN's denial, the immediate technical implication is that their security measures may be robust enough to prevent such attacks. False claims of breaches can cause unnecessary panic and undermine trust in legitimate security services. This incident highlights the importance of verifying claims before accepting them as fact, especially in the cybersecurity field where misinformation can have serious consequences. For cybersecurity professionals, this underscores the need for thorough investigation and verification of breach claims. It also highlights the importance of transparent communication from companies about their security measures to maintain trust and credibility. In conclusion, while the claim by "1011" is serious, the lack of evidence and NordVPN's denial suggest that this may be another false claim in a series of similar incidents. Cybersecurity professionals should remain vigilant and demand evidence before accepting such claims as fact.

The data leak site associated with Salesforce, breachforums[.]hn, appears to be undergoing seizure. Recent WHOIS data reveals that the domain's name servers have been updated to Cloudflare's infrastructure (hans.ns.cloudflare.com and surina.ns.cloudflare.com), a common indicator of law enforcement action. This suggests that authorities may be taking control of the domain to disrupt its operations or gather intelligence. The site is reportedly used by the group ScatteredLAPSUS$Hunters, which has been involved in data breaches. Notably, the corresponding onion site remains operational, indicating that while the clearnet presence is being targeted, the dark web operations continue unimpeded. This development highlights the ongoing cat-and-mouse game between law enforcement and cybercriminals. For cybersecurity professionals, this serves as a reminder of the importance of monitoring both clearnet and dark web activities for comprehensive threat intelligence. The situation is fluid, and further updates are expected as more information becomes available. Organizations should remain vigilant and ensure that their incident response plans are up to date. Continuous monitoring and threat intelligence sharing are crucial in staying ahead of such threats.

Two domains were seized, but one returned quickly