Scattered Spider Meets Honeypot: When the Hunters Become the Hunted
- Patrick Duggan
- Jan 8
- 3 min read
The Setup
After detecting reconnaissance activity targeting their externally exposed services, Resecurity didn't just block the traffic. They steered it.
They built a honeypot. Not a simple one—a convincing one.
28,000+ synthetic consumer records (impersonated individuals)
190,000+ fake payment transactions
Generated messages within collaboration systems
Already-breached data from the dark web to add authenticity
They used real breach data to make fake systems look lived-in. That's tradecraft.
The Sting
The threat actors—claiming to be ShinyHunters, a faction of the Scattered Lapsus$ Hunters (SLH) alliance—took the bait.
They accessed the emulated applications. They exfiltrated the synthetic data. They posted screenshots as proof, claiming "full access" to Resecurity's systems.
Then Resecurity dropped the reveal.
The "compromised" systems were isolated honeypots. The "stolen" data was fabricated. The screenshots proved nothing except that the attackers fell for a trap.
The Denial
After the reveal, someone claiming to represent "the actual ShinyHunters" denied involvement. Classic.
It wasn't them (and someone used their name)
It was them (and they're embarrassed)
The group is fragmented enough that different factions operate independently
Option 3 is most likely. "Scattered Spider" isn't a monolithic organization—it's a loose alliance of actors using similar techniques. Some hit ESA. Some got honeypotted.
The Counter-Intel Playbook
What Resecurity did is textbook counter-intelligence:
┌─────────────────────────────────────────────────────────────────┐
│ ACTIVE DEFENSE PLAYBOOK │
├─────────────────────────────────────────────────────────────────┤
│ │
│ 1. DETECT RECONNAISSANCE │
│ └── Monitor for scanning, enumeration, probing │
│ └── Don't just block—observe and categorize │
│ │
│ 2. PREPARE THE TRAP │
│ └── Build isolated honeypot environment │
│ └── Populate with convincing synthetic data │
│ └── Use real breach data for authenticity │
│ │
│ 3. STEER THE ADVERSARY │
│ └── Make honeypot more attractive than production │
│ └── Allow "successful" access │
│ └── Let them exfiltrate fake data │
│ │
│ 4. COLLECT INTELLIGENCE │
│ └── Log TTPs, tools, infrastructure │
│ └── Attribute activity to known groups │
│ └── Build defensive signatures │
│ │
│ 5. BURN THE OPERATION │
│ └── Public reveal damages attacker credibility │
│ └── "Full access" claims become embarrassment │
│ └── Other targets become more skeptical of extortion │
│ │
└─────────────────────────────────────────────────────────────────┘This isn't passive defense. This is hunting.
Why This Matters
For defenders: You can do more than block. You can deceive. You can waste attacker resources. You can burn their operations publicly.
For the threat landscape: Scattered Spider's credibility takes a hit. When they claim to have breached the next target, there's now precedent for it being a trap. That uncertainty has value.
For attribution: The "real ShinyHunters" denial reveals fragmentation. These groups aren't unified commands—they're loose affiliations. Different cells, different targets, different outcomes.
The Contrast
Date | Target | Outcome |
January 2026 | ESA | 500GB exfiltrated, ongoing access claimed |
January 2026 | Resecurity | Honeypotted, fake data, public embarrassment |
Same week. Same group (allegedly). Wildly different results.
The difference? Resecurity was watching for them. ESA apparently wasn't.
Recommendations
Don't just block—consider why they're interested
Evaluate whether a honeypot makes sense for your threat model
Document everything for attribution and intelligence sharing
Isolate honeypots completely from production
Make fake data convincing (Resecurity used real breach data)
Have a disclosure plan—the reveal is part of the operation
Verify before paying or panicking
Ask for proof that isn't publicly available
Consider that you might be looking at honeypot data
The Larger Pattern
We've now written three posts about Scattered Spider in the last 24 hours:
**Scattered Spider Goes to Space** - ESA breach, 500GB spacecraft data
This post - Resecurity honeypot, fake data, burned operation
(Ongoing) - The OAuth arc continues
The group isn't slowing down. But neither are defenders. Some get owned. Some do the owning.
Sources
About DugganUSA: We publish free threat intelligence for the 99% who can't afford enterprise security. Our STIX 2.1 feed tracks 2,200+ blocked IPs with MITRE ATT&CK attribution. Sometimes the hunters become the hunted.
Her name is Renee Nicole Good.
Comments