Loading story…
Elsevier.com, Evolve.elsevier.com, and Submit.elsevier.com briefly redirected visitors to a page branded “LAPSUS$ GROUP, Chapter II.” Cloudskope said the apparent hijack lasted at least 78 minutes and likely resulted from a DNS or CDN edge-configuration change. Related reports said Evolve, Sherpath, and ClinicalPharmacology users encountered extortion-themed pages linked to lapsus[.]ar[.]io and lapsus[.]bz, disrupting access to examinations and simulation-charting resources used by medical and nursing students.
The affected sites were cleaned and restored, but Elsevier had not publicly explained the cause or disclosed whether credentials, customer data, or internal systems were compromised. The page claimed a connection to LAPSUS$ and hinted at another victim, but researchers cautioned that available evidence does not establish attribution or continuity with the original 2021–2022 LAPSUS$ operation; claims involving GSDD APIs also remain unsubstantiated.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Elsevier.com, Evolve.elsevier.com, and Submit.elsevier.com redirected visitors to a page branded “LAPSUS$ GROUP, Chapter II.” Cloudskope observed the redirect from approximately 7:49 p.m. CT until before 10:09 p.m. CT, for at least 78 minutes.
Sorami Consulting reported redirects affecting Elsevier Evolve, Sherpath, and ClinicalPharmacology to extortion-themed pages associated with LAPSUS$, referencing lapsus[.]ar[.]io and lapsus[.]bz. Public discussion described nursing and medical students being unable to access exams and simulation charting; the report did not establish the compromise mechanism or independently verify attribution.
Elsevier cleaned and restored the affected domains to functioning status following the temporary redirection. The company had not publicly explained the cause or said whether credentials or other user data were compromised.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor using the **LAPSUS$** name has claimed an alleged breach of **AstraZeneca** and is offering a purported **3GB** compressed dump of internal data for sale rather than releasing it publicly. Posted samples and screenshots were used to support the claim, with reports describing a pay-to-access extortion model and password-protected links containing redacted material as proof of access. The allegedly stolen data includes source code, cloud infrastructure configurations, employee and contractor-related records, and access material such as cryptographic keys, Vault credentials, and GitHub and Jenkins tokens. Analysis of the shared samples suggested that some data, including GitHub Enterprise-style user information and third-party contractor access records, appeared plausibly authentic and internally sourced, while at least one financial dataset looked generic and possibly unrelated. Public references to an internal repository tied to AstraZeneca’s supply-chain portal indicate possible exposure of systems supporting forecasting, inventory tracking, SAP integration, and OTIF delivery metrics. The most serious risk would come from any genuine secrets, private keys, or cloud configuration data, but the breach claim and full scope of the exposed material remained unverified, and AstraZeneca had not publicly confirmed the incident at the time of reporting.
Jun 29, 2026
Microsoft confirmed that **LAPSUS$** compromised a single employee account and used that foothold to gain limited access to internal source-code repositories, leading to the leak of code tied to projects including **Bing**, **Cortana**, and **Bing Maps**. The company said no customer code or customer data was affected and that the compromised account was remediated, but the incident reinforced the group’s ability to turn relatively simple access methods into high-impact breaches at globally recognized targets. Reporting across multiple investigations describes LAPSUS$ as a fast-moving **data extortion** actor that relied heavily on **social engineering**, **SIM swapping**, **credential theft**, **session-token abuse**, **MFA fatigue**, help-desk manipulation, and purchases or solicitation of insider access rather than advanced malware or ransomware deployment. The group publicly used **Telegram** to leak stolen data, pressure victims, and recruit access brokers, and it was linked to intrusions affecting organizations including **NVIDIA, Okta, Samsung, Microsoft, Vodafone Portugal, Ubisoft, LG**, and Brazil’s **Ministry of Health**; researchers said its behavior mixed financial motives with disruption, publicity, and notoriety, suggesting the threat could persist through remaining members or copycat actors even after arrests.
Aug 15, 2026
Leaked documents indicate the **LAPSUS$** extortion group compromised Sykes Enterprises, an Okta subprocessor owned by Sitel Group, and maintained access from January 16 to January 21 while using tools including `Mimikatz` and disabling security controls. Screenshots later published by the group appeared to show access to an Okta support engineer’s workstation, prompting scrutiny of whether attackers could use that access to interact with customer tenants through support channels rather than by breaching Okta’s core service directly. Okta said its own service was not directly breached, but later acknowledged it should have communicated and acted faster after receiving Sitel’s summary report on March 17, days before LAPSUS$ published evidence of the intrusion. The company said the maximum potential impact reached **366 customers**, while leaked customer notifications and an intrusion timeline raised broader concerns about Sitel/Sykes’ security posture and Okta’s handling of the incident disclosure.
Aug 14, 2026