Hackers claim breach, victim claims honeypot
Resecurity says attackers fell for the oldest trick in the book
A hacking group claims to have breached US-based cybersecurity firm Resecurity – but the company says they only accessed a deliberately planted honeypot environment.
Threat actors allegedly from Scattered Lapsus$ Hunters (SLH) posted screenshots on Telegram on Saturday, claiming they had gained "full access" to Resecurity's systems.
They alleged the theft of employee data, internal chats and logs, threat intelligence reports and a complete client list with detailed information.
"We would like to announce that we have gained full access to Resecurity systems," the group wrote, adding that it had obtained "internal chats and logs", "employee data", "threat intel related reports" and client details.
The attackers shared screenshots apparently taken from Resecurity's internal systems.
One image appears to show a Mattermost collaboration platform with messages between individuals identified as Resecurity staff and representatives of Pastebin, the text-sharing service, discussing malicious content hosted on the platform.
Scattered Lapsus$ Hunters is said to be a collaboration between several well-known cybercrime collectives, including ShinyHunters, Lapsus$ and Scattered Spider.
The hackers said the attack was retaliation for efforts by Resecurity to socially engineer members of the group, to gather intelligence about its activities.
The attackers said Resecurity staff posed as potential buyers during the purported sale of a database linked to Vietnam's financial system, requesting free samples and additional information.
A spokesperson for ShinyHunters told BleepingComputer they were not involved in the incident.
While ShinyHunters has previously claimed to be part of the broader Scattered Lapsus$ Hunters grouping, the spokesperson said the group did not take part in this alleged attack.
Resecurity denies any breach
Resecurity has rejected the hackers' claims, saying the systems shown in the screenshots were not part of its real production environment.
Instead, it says the attackers interacted with a honeypot - a controlled, isolated system designed to attract intruders so their behaviour can be monitored without putting real data at risk.
In a report shared and published on 24th December, Resecurity said it first detected suspicious activity on 21st November 2025, when a threat actor began probing its publicly exposed systems.
The firm said its digital forensics and incident response (DFIR) team identified early signs of reconnaissance and logged multiple IP addresses associated with the activity.
These included addresses traced to Egypt as well as connections routed through Mullvad, a virtual private network provider.
In response, Resecurity said it deployed a honeypot account in an isolated environment.
This allowed the attacker to log in and interact with systems populated with fabricated customer, employee and payment data, while researchers monitored every action.
The honeypot was apparently filled with synthetic datasets designed to mimic real business information.
The attacker(s) began attempting to automate data extraction in December.
Between 12th and 24th December, Resecurity says it recorded more than 188,000 automated requests, many routed through large numbers of residential proxy IP addresses.
The firm said it gathered extensive telemetry on the attacker's tactics and claims the attackers made several operational security mistakes, briefly exposing confirmed IP addresses when proxy connections failed.
It is not the first time the Scattered Lapsus$ Hunters group has claimed responsibility for a breach.
In August, it alleged it had compromised the accounts of all 2.5 billion Gmail users, a claim that Google firmly dismissed.
A month later, the group said in messages posted on Telegram and the dark web marketplace BreachForums that it had "decided to go dark". This came following the arrest and court appearance of two suspected members in connection with a cyberattack on Transport for London (TfL).