operational-disruptionransomware-group-operationeducation-sector-threatthreat-infrastructure-tracking

Elsevier Domains Redirected to LAPSUS$-Branded Extortion Page

Breach & Incident Intelligence · 5 sources · Updated 2mo ago · First seen Sep 22, 2026

Elsevier.com, Evolve.elsevier.com, and Submit.elsevier.com briefly redirected visitors to a page branded “LAPSUS$ GROUP, Chapter II.” Cloudskope said the apparent hijack lasted at least 78 minutes and likely resulted from a DNS or CDN edge-configuration change. Related reports said Evolve, Sherpath, and ClinicalPharmacology users encountered extortion-themed pages linked to lapsus[.]ar[.]io and lapsus[.]bz, disrupting access to examinations and simulation-charting resources used by medical and nursing students.

The affected sites were cleaned and restored, but Elsevier had not publicly explained the cause or disclosed whether credentials, customer data, or internal systems were compromised. The page claimed a connection to LAPSUS$ and hinted at another victim, but researchers cautioned that available evidence does not establish attribution or continuity with the original 2021–2022 LAPSUS$ operation; claims involving GSDD APIs also remain unsubstantiated.

Is this vendor in your chain?See attribution, scope, and your downstream exposure.

Check the blast radius

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Sep 21, 2026

Reported Sep 23, 20262mo ago
Elsevier says redirect incident did not compromise core systems or data
Elsevier confirmed the September 21 redirect attack was narrowly scoped and short-lived, and said its cybersecurity team restored normal service. The company stated it found no indication that its core platforms, customer data, research content, or operational systems were compromised.
Academic publisher Elsevier hit by LAPSUS$ redirect attack
Reported Sep 22, 20262mo ago
Reports describe related access disruption to Elsevier services
Sorami Consulting reported redirects affecting Elsevier Evolve, Sherpath, and ClinicalPharmacology to extortion-themed pages associated with LAPSUS$, referencing lapsus[.]ar[.]io and lapsus[.]bz. Public discussion described nursing and medical students being unable to access exams and simulation charting; the report did not establish the compromise mechanism or independently verify attribution.
Elsevier Evolve, ClinicalPharmacology, and GSDD APIs Hijacked: LAPSUS$ Redirect Campaign - Malware News - Malware Analysis, News and Indicators
Reported Sep 22, 20262mo ago
Elsevier restores affected domains after redirect incident
Elsevier cleaned and restored the affected domains to functioning status following the temporary redirection. The company had not publicly explained the cause or said whether credentials or other user data were compromised.
Brief hijack makes Elsevier domains redirect to LAPSUS$ "Chapter II" page - Help Net Security
Sep 21, 20262mo ago
Elsevier domains redirect to LAPSUS$-branded page
Elsevier.com, Evolve.elsevier.com, and Submit.elsevier.com redirected visitors to a page branded “LAPSUS$ GROUP, Chapter II.” Cloudskope observed the redirect from approximately 7:49 p.m. CT until before 10:09 p.m. CT, for at least 78 minutes.
Brief hijack makes Elsevier domains redirect to LAPSUS$ "Chapter II" page - Help Net Security

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

LAPSUS$

Organizations

1 linked

Elsevier

Breaches

1 linked

ELSEVIER-2026-09

Observables

2 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See attribution, scope, and whether this vendor sits anywhere in your supply chain.

Get the Full Incident Picture

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

ScworldNews · Sep 24, 2026

Elsevier platform briefly redirected to LAPSUS$ leak site | brief | SC MediaOpen source ↗

DysruptionhubNews · Sep 24, 2026

Elsevier web hijack disrupts Missouri nursing courseworkOpen source ↗

Academic publisher Elsevier hit by LAPSUS$ redirect attackOpen source ↗

Malware NewsNews · Sep 22, 2026

Elsevier Evolve, ClinicalPharmacology, and GSDD APIs Hijacked: LAPSUS$ Redirect Campaign - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Help Net SecurityNews · Sep 22, 2026

Brief hijack makes Elsevier domains redirect to LAPSUS$ "Chapter II" page - Help Net SecurityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

operational-disruptionransomware-group-operationeducation-sector-threatthreat-infrastructure-tracking

Elsevier Domains Redirected to LAPSUS$-Branded Extortion Page

Breach & Incident Intelligence · 5 sources · Updated 2mo ago · First seen Sep 22, 2026

Is this vendor in your chain?See attribution, scope, and your downstream exposure.

Check the blast radius

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Sep 21, 2026

Reported Sep 23, 20262mo ago
Elsevier says redirect incident did not compromise core systems or data
Elsevier confirmed the September 21 redirect attack was narrowly scoped and short-lived, and said its cybersecurity team restored normal service. The company stated it found no indication that its core platforms, customer data, research content, or operational systems were compromised.
Academic publisher Elsevier hit by LAPSUS$ redirect attack
Reported Sep 22, 20262mo ago
Reports describe related access disruption to Elsevier services
Sorami Consulting reported redirects affecting Elsevier Evolve, Sherpath, and ClinicalPharmacology to extortion-themed pages associated with LAPSUS$, referencing lapsus[.]ar[.]io and lapsus[.]bz. Public discussion described nursing and medical students being unable to access exams and simulation charting; the report did not establish the compromise mechanism or independently verify attribution.
Elsevier Evolve, ClinicalPharmacology, and GSDD APIs Hijacked: LAPSUS$ Redirect Campaign - Malware News - Malware Analysis, News and Indicators
Reported Sep 22, 20262mo ago
Elsevier restores affected domains after redirect incident
Elsevier cleaned and restored the affected domains to functioning status following the temporary redirection. The company had not publicly explained the cause or said whether credentials or other user data were compromised.
Brief hijack makes Elsevier domains redirect to LAPSUS$ "Chapter II" page - Help Net Security
Sep 21, 20262mo ago
Elsevier domains redirect to LAPSUS$-branded page
Elsevier.com, Evolve.elsevier.com, and Submit.elsevier.com redirected visitors to a page branded “LAPSUS$ GROUP, Chapter II.” Cloudskope observed the redirect from approximately 7:49 p.m. CT until before 10:09 p.m. CT, for at least 78 minutes.
Brief hijack makes Elsevier domains redirect to LAPSUS$ "Chapter II" page - Help Net Security

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →