Lapsus$ Chapter II: what renewed targeting means for defenders

TL;DR: Lapsus$ Group posted a “Chapter II” leak-site message on September 10, 2026, claimed it was back from retirement, and signalled intent to target the FBI while teasing a new victim tied to more than USD 50 billion in annual revenue, according to ZeroFox. The episode shows how extortion brands can persist through reactivation, splintering, and publicity rather than disappear after arrests.

Editorial analysis by NHI Mgmt Group, based on content published by ZeroFox: “Flash Report: Lapsus$ Group Announces Resurgence”.

By the numbers:

• The teaser describes a global company generating more than USD 50 billion in annual revenue.

Key questions

Q: What should organisations do when a known extortion group appears to return after a public hiatus?

A: Treat the announcement as a live threat signal, not a branding exercise.

Q: Why do criminal leak-site announcements create real security risk even before an intrusion is confirmed?

A: Because they can trigger operational pressure, media amplification, and defensive distraction while also signalling intent to attack.

Q: How can security teams tell whether a revived threat brand is genuine or just reused by another actor?

A: They should compare infrastructure, targeting patterns, disclosure style, and victim overlap instead of relying on the name alone.

Practitioner guidance

• Monitor leak sites for brand reactivation signals Track signed announcements, countdown clocks, and victim teasers as threat-intelligence leads rather than as publicity noise.
• Separate campaign analysis from actor branding Record infrastructure, victim selection, and messaging patterns independently so you can judge whether a named group is genuinely back or simply being reused.
• Expand response planning to personnel risk Include doxxing, harassment, and law-enforcement targeting in incident playbooks when a group publicly names institutions or individuals.

Bottom line: The article is less about a new exploit and more about the durability of a criminal brand that can reappear after disruption.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →