Scattered Spider / SLSH just launched a new Telegram channel — and the activity shows a clear escalation in both tone and targeting.
Early observations from the new channel:
•They’re bragging about 300+ victims individually, claiming higher earnings than Qilin & Cl0p combined.
•They’re mocking AT&T & Verizon, saying both get “hit yearly by the same group.”
•They’re showcasing what appear to be internal dashboards from CrowdStrike, Cellebrite user forms, and employee directories from major U.S. telecom providers.
•They issued explicit threats toward researchers and security vendors.
•They continue naming new targets — LinkedIn, DocuSign, MalwareBytes, Verizon, GitLab, Atlassian, Thomson Reuters, F5, SonicWall.
•They repeatedly push a narrative of “quality over quantity,” framing themselves as superior to ransomware crews.
•They also tease a major announcement for 24 November — consistent with their pattern of theatrics.