"Not real data"… LISECURITY publicly refutes hacker attack claims and discloses honeypot strategies

Cybersecurity company Resecurity has publicly refuted allegations of intrusion by the notorious hacker group ShinyHunters. Resecurity stated that these hackers did not actually breach genuine internal systems but instead fell into deliberately set “honeypots,” dismissing the possibility of data leaks. This incident has garnered attention as a typical example demonstrating the effectiveness of synthetic data and deception techniques in cybersecurity threat response strategies.

The controversy began with a Telegram account called “Scattered Lapsus$ Hunters.” This account is believed to be associated with malicious ransomware groups such as ShinyHunters, LAPSUS$, and Scattered Spider. They claimed to have infiltrated Resecurity’s internal systems, stealing employee information, client lists, internal chat logs, security reports, and other data.

However, Resecurity immediately denied these allegations across social media platform X and continued to provide technical rebuttals through its company blog. According to the blog, the systems accessed by the attackers were part of a honeypot composed of virtual environments isolated from real infrastructure. These included fake user accounts, forged transaction records, and decoy applications. The company explained that all this data was synthetic, disguised as real information, and was entirely fabricated.

The company specifically pointed out that since discovering this reconnaissance attempt last year, Resecurity had activated its forensic and incident response teams, intentionally guiding the attackers toward bait accounts. Under monitored conditions, the attackers interacted with the system, allowing the company to gather valuable intelligence on threat actor behaviors and attack methods.

Resecurity reiterated that all data accessed by the hackers was fabricated for deception purposes, and no customer information or real credentials were compromised. The company also commented that this case exemplifies not only defensive measures but also proactive cybersecurity defense by detecting and analyzing potential threat actors.

This incident symbolically demonstrates the evolution of cybersecurity strategies from mere blocking to information collection and detection-centered approaches. By using fake data instead of real internal information to track attackers’ intentions, the application of synthetic data honeypots is expected to continue increasing in the future.