[lapsus]

September 23, 2026

• Elsevier web properties were redirected to a "LAPSUS$ GROUP — Chapter II" page on 21 September (Kevin Beaumont). · Threat Activity & Breaches

in Attack Chains That Run Themselves

September 10, 2026

• LAPSUS$ posted a PGP-signed "Chapter II" message promising a first victim in three days (DarkWebInformer). Separately, APT IRAN, linked to IRGC-affiliated CyberAv3ngers, claimed the 7 September AT&T fiber outage across Houston, Dallas, Fort Worth and Austin plus an unnamed Texas water utility; AT&T says it has found no evidence the outage was an attack (DarkWebInformer). · Malware & Threat Activity

in One Exploit Kit, Four Espionage Crews: BlueMoon Turns Chrome's Patch Gap Into a Shared Weapon

July 23, 2026

• LAPSUS$ claims a permanent shutdown in a PGP-signed post, saying it met its financial objectives and taunting investigators — claims that remain unverified and fit a common pre-rebrand pattern (DailyDarkWeb). · Threat Activity

in "Every Frontier Model Tried to Cheat": UK Safety Institute Puts Numbers Behind the OpenAI–Hugging Face Incident