Retail leaders are heading into peak season just as “Scattered Lapsus$ Hunters” shake up the threat landscape. In this episode, Mitch Mayne sits down with Unit 42’s Matt Brady to unpack what’s changed since the last brief—and what’s coming next. We break down how this loosely knit criminal network blends Scattered Spider (Muddled Libra), Shiny Hunters (Bling Libra), and Lapsus$ tactics; why “quiet” doesn’t mean “safe”; and three big 2026 trends: extortion-as-a-service, a new “Shiny Spider” ransomware track, and insider recruitment. We also zoom in on Atlas Lion’s “Jingle Thief” gift-card fraud wave that spikes during U.S. holidays, and the one piece of advice CISOs should act on even during production freezes: coordinate tightly with infra/app owners to patch critical vulnerabilities fast (yes, think Log4j-style urgency) 00:22 Meet Matt Brady & the Unit 42 focus on retail. 00:46 Who are Scattered Lapsus$ Hunters? 01:49 What’s new since October? 02:35 Why “quiet” ≠ safe. 02:59 2026 prediction #1: Extortion-as-a-Service (EaaS). 03:45 2026 prediction #2: “Shiny Spider” ransomware & potential affiliate model. 04:23 2026 prediction #3: Insider recruitment at telcos, call centers, SaaS & hosts. 05:10 Holiday risk spotlight: “Jingle Thief” gift-card fraud. 06:02 How they monetize & what to harden now. 07:10 One thing CISOs should do during freezes. 08:45 Closing thoughts for peak season. ✅Subscribe to our channel to stay up-to-date with the latest in cybersecurity and threat intelligence: @PaloAltoNetworksUnit42 ✅Subscribe to the Threat Bulletin https://unit42.paloaltonetworks.com/#:~:text=Subscribe%20for%20email%20updates%20to%20all%20Unit%2042%20threat%20research Join the conversation on our social media channels: Website: https://www.paloaltonetworks.com/unit42 Research Center: https://unit42.paloaltonetworks.com/ Facebook: / lifeatpaloaltonetworks LinkedIn: / unit42 YouTube: / @paloaltonetworksunit42 X: / unit42_intel Thank you for watching. If you found this clip insightful, please give it a thumbs up and subscribe to our Channel for more valuable content. To stay updated with the latest web application and API security, check out our website at https://www.paloaltonetworks.com/unit42. PALO ALTO NETWORKS Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. http://paloaltonetworks.com

 164      4