Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page
Three Elsevier domains, including manuscript portal submit.elsevier.com, redirected for 78 minutes to a LAPSUS$ extortion page taunting the FBI.
On September 21, 2026, elsevier.com, evolve.elsevier.com and submit.elsevier.com redirected to a page branded 'LAPSUS$ GROUP, Chapter II' carrying a signed statement mocking the FBI and counting down to a future victim. Cloudscope researchers say the redirect ran at least 78 minutes (7:49pm to before 10:09pm CT) and was likely caused by a DNS record, CDN redirect rule, or management-account change; a Chinese forum post claiming altered Cloudflare redirect rules could not be verified. Elsevier has offered no explanation or statement on possible credential theft. Securonix found no evidence of personnel continuity with the original 2021-2022 LAPSUS$ cluster, though a 2026 LAPSUS$-branded leak site named Virta Health, Vodafone Germany and AYA Bank.
- 78-minute redirect of elsevier.com, evolve.elsevier.com, submit.elsevier.com on September 21, 2026
- Suspected cause: DNS record, CDN redirect rule, or compromised management account
- Elsevier has not explained incident or addressed possible credential theft
- Securonix finds no confirmed continuity with original 2021-2022 LAPSUS$ actors
- Threat actors
- LAPSUS$
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | elsevier.com | ffected domains The three “hijacked” Elsevier domains were: Elsevier.com (the main company website) Evolve.elsevier.com (a login por |
| domain | evolve.elsevier.com | evier domains were: Elsevier.com (the main company website) Evolve.elsevier.com (a login portal and learning management system for nursing |
From the original article
2 min read at helpnetsecurity.com
Three domains / web portals belonging to Dutch academic publishing company Elsevier have been redirecting users to a page branded “LAPSUS$ GROUP, Chapter II,” carrying a signed statement that taunted the FBI and counted down to a future victim. According to Cloudscope researchers, the redirect ran for at least 78 minutes, from roughly 7:49pm CT until it was cleared before 10:09pm CT on September 21, 2026.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.