ALP-001

ALP-001 is a financially motivated ransomware group that first emerged in March 2026. Initially operating as an Initial Access Broker, the group strategically expanded its operations to include direct extortion, signifying a shift from selling network access to leveraging it for ransomware activities. ALP-001 operates a Tor-based data leak site where it publishes exfiltrated data, although the group has been noted for potentially using questionable or fabricated leak claims, sometimes involving publicly available or misconfigured data, to pressure large enterprises. This behavior suggests an opportunistic and potentially unreliable operational model.