Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page

Three domains / web portals belonging to Dutch academic publishing company Elsevier have been redirecting users to a page branded “LAPSUS$ GROUP, Chapter II,” carrying a signed statement that taunted the FBI and counted down to a future victim.

According to Cloudscope researchers, the redirect ran for at least 78 minutes, from roughly 7:49pm CT until it was cleared before 10:09pm CT on September 21, 2026.

Elsevier is yet to offer an explanation on how it happened or say whether users should worry about their login credentials or other data having been stolen, but the affected domains and portals have been “cleaned” and are accessible and functional again.

The affected domains

The three “hijacked” Elsevier domains were:

• Elsevier.com (the main company website)
• Evolve.elsevier.com (a login portal and learning management system for nursing and health-professions education)
• Submit.elsevier.com (a portal where researchers upload manuscripts for peer review)

Users were redirected to a page showing the following notice:

Cloudscope researchers believe the redirect was effected “with a change at the DNS or CDN edge: a DNS record, a CDN redirect rule, or the account that manages them.”

“A Chinese-language forum post claims the actor altered Elsevier’s Cloudflare redirect rules. We could not verify that,” they added.

We’ve reached out to Elsevier with questions about what happened, and we’ll update this item if we receive a reply.

A revived brand

Lapsus$ Group, known for its extortion-focused attacks against large tech companies like Microsoft, Okta, Nvidia and Uber, is believed to have been inactive since late 2022, following the arrests and convictions of some of its members.

Still, some of the remaining members possibly joined the Scattered Lapsus$ Hunters collective in 2025, which continued with high-profile data breaches and extortion attempts.

However, in 2026, a Lapsus$-branded leak site named new victim organizations: US healthcare firm Virta Health, Vodafone Germany, AYA Bank, and others.

This latest statement seems to imply that the group is back and strong, and plans to target (or has targeted already) a “global company generating over $50 billion in annual revenue, with operations and a strong presence worldwide.”

Whether this claim is true or not, remains to be seen.

Securonix researchers, who analyzed the same page earlier this month, said that “none of the evidence reviewed so far establishes personnel continuity with the original 2021-2022 LAPSUS$ cluster.”

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

from Help Net Security https://ift.tt/tJSHTQn

Related Items