In October 2025, we published two Insights blogs on threat activity affiliated with the cybercriminal alliance known as Scattered LAPSUS$ Hunters (SLSH). After a few weeks of apparent inactivity, the threat actors have returned with a vengeance based on open-source reporting and conversations obtained from a new Telegram channel (scattered LAPSUS$ hunters part 7). This latest Insights threat blog will detail several notable observations made by Unit 42 since mid-November, and prepares organizations as we head into the holiday season. On Nov. 20, 2025, Salesforce released a security advisory acknowledging that they had detected “unusual activity involving Gainsight-published applications.” This led the company to revoke “all active access and refresh tokens associated with…