ZeroFox Intelligence Flash Report - Lapsus$ Group Announces Resurgence

Product Serial: F-2026-09-18a

TLP:CLEAR

In this Flash Report, ZeroFox researchers report on the Lapsus$ Group's recent post declaring its intent to renew its operations and target law enforcement, after a hiatus period following law enforcement disruptions.

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On September 10, 2026, threat collective Lapsus$ Group posted a message on its leak site declaring a "Chapter II" return from retirement and stating an intent to directly target the Federal Bureau of Investigation (FBI).
The group's Chapter II announcement likely serves as an official declaration of its reactivated operations and likely indicates that fresh cyber offensive actions are already taking place.
The leak site's "Upcoming Target" listing describes a global company generating more than USD 50 billion in annual revenue, with a countdown clock that showed roughly 10 days remaining as of the writing of this report.
The Chapter II announcement very likely marks a genuine, ongoing resumption of Lapsus$ Group’s offensive operations and will likely garner substantial near-term media coverage given the collective’s name reputation and recognition among security teams and the general public.