Elsevier Web Properties Hijacked to Display LAPSUS$ Extortion Page

On September 21, 2026, attackers successfully executed a DNS hijacking attack against Elsevier, compromising the domain registrar records for elsevier.com, scopus.com, and sciencedirect.com. For 78 minutes, legitimate traffic was redirected via HTTP 302 responses to a malicious host (185.XX.XX.XX/24) controlled by the LAPSUS$ threat group. The redirection served a "Chapter II" extortion page featuring a JavaScript countdown and taunts directed at federal law enforcement. While no data exfiltration or malware delivery was confirmed, the incident demonstrates a critical supply chain vulnerability within the domain management lifecycle, impacting tens of thousands of global academic users.

• Incident Overview & Timeline

  • Simultaneous compromise of three major Elsevier web portals.
  • Redirection window: 19:49 CT to 22:09 CT (78-minute duration).
  • Users encountered a LAPSUS$ "Chapter II" extortion landing page.
  • Service interruption affected a massive global academic user base.

• Attack Mechanics & Technical Vector

  • Unauthorized modification of DNS A/AAAA (or CNAME) records at the registrar level.
  • Legitimate hostnames were resolved to the attacker-controlled IP range 185.XX.XX.XX/24.
  • The malicious host utilized a low-trust Certificate Authority (SSL serial: 0xAB12) to serve the page.
  • Attackers utilized HTTP 302 redirects to bypass standard site availability.

• Threat Actor Profile: LAPSUS$

  • Claimed responsibility via a signed statement on the hijacked Elsevier landing page.
  • Known for high-profile, rapid-turnaround intrusions targeting large enterprises (e.g., NVIDIA, Okta).
  • Tactics focus on extortion and reputational damage through DNS and credential-based hijacking.
  • Group operates with fluid membership and high-impact, low-persistence execution.

• Indicators of Compromise & Defensive Actions

  • Malicious Infrastructure: IP range 185.XX.XX.XX/24 hosting extortion content.
  • DNS Event Window: 20260921T19:49:00Z to 20260921T22:09:00Z.
  • Mitigation: Implement DNSSEC, registrar-level account MFA, and strict registrar locks.
  • Monitoring: Enable real-time alerting for all DNS record changes via registrar APIs.

• Impact & Strategic Lessons

  • Significant reputational risk and potential breach of service-level agreements (SLAs).
  • Exposed critical supply chain weakness in third-party registrar security controls.
  • Underscores the necessity of robust change management and rapid DNS rollback protocols.
  • Highlights the danger of unauthorized administrative access to domain management interfaces.