The 2025 social-engineering campaign is tracked as ShinyHunters by some researchers and UNC6040 by others, and is reported as operating in tandem with the cluster tracked as Scattered Spider.
A Designation Is A Research Artefact, Not An Organisation
This desk filed at 25-0512 that "Scattered Spider" names a fluid set of individuals rather than an entity with a membership list, and at 26-0217 that tradecraft resemblance is not identification.
Two vendors tracking the same behaviour under different names is the ordinary condition. Each maintains its own clustering criteria, and the labels are not interchangeable claims about who anyone is.
Which Produces A Counting Problem
The corpus recorded 124 active ransomware groups at 25-1226 and 73 new entrants in one year, and noted that a "new group" is generally a new leak-site brand.
The same inflation risk applies to intrusion-set designations. If two labels describe one activity set, any tally of distinct actors overstates the population — and 25-1215b observed that the same five names appear across every sector, which is what you would expect if the labelled population is smaller than the label count.
"Working In Tandem" Is Doing A Lot Of Work
Reporting describes cooperation between clusters. That could mean shared personnel, purchased access, common infrastructure, or simply that two sets of researchers observed overlapping behaviour and reconciled their naming.
The corpus filed at 25-0905 that combined operations pool specialised capability, and treated the naming as a merger announcement. This file records the alternative reading: apparent collaboration may sometimes be an artefact of independent labelling schemes meeting.
Graded medium: the designations are documented, and this desk cannot establish the relationship between them.
It examines attribution labelling as applied to the 2025 campaign. No claim is made about the identity or composition of any named cluster. Corrections: corrections@forensicpost.com.