Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group

Alp-001 ransomware

17 victims listed on the Alp-001 leak site across 11 countries. Most recent disclosure .

Victims
17
0.1% of all tracked
Countries
11
Most: United States
Sectors
4
Most: Technology
First seen
Mar 2026
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Alp-001 and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Alp-001 is an elusive cyber threat actor known to have targeted at least seventeen victims across eleven countries.

Who Alp-001 is

⚠️ The group appears unreliable. Most, if not all, of its alleged victims cannot be verified. WE HAVE DECIDED TO REMOVE ENTRIES FOR THIS GROUP

Recorded activity

Disclosures attributed to Alp-001 in this database run from March 2026 to April 2026, totalling 17 victims — 0.1% of everything tracked here. Alp-001 has listed victims in 11 countries in this database, most often United States, followed by France and Poland. The sectors appearing most in its listings are Technology, Telecommunication, Manufacturing.

YARA detection rules

ALP-001.yar 
/*
ALP 001 ransomware
*/

rule ALP_001_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.alp001"
        description = "Detects ALP 001 ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "ALP-001" ascii nocase
        $name2 = "ALP-001" ascii
        $onion  = "alp001.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Alp-001, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.

Threat actor analysis

Alp-001 has disclosed 17 victims on its leak site, 0.1% of all ransomware listings tracked in this database. Its earliest disclosure here dates to March 2026.

The group has listed organisations in 11 countries, most often in United States (4 victims), followed by France, Poland, Italy.

By industry, its listings concentrate in Technology, Telecommunication, Manufacturing — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Alp-001 is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Alp-001 victims 17

Organization Disclosed
aviwest.com
FRFrance
inatech.com
GBUnited Kingdom
nepgroup.com
USUnited States
artmotion.net
CHSwitzerland
asseco-ce.com
PLPoland
iliad.fr
FRFrance
knewin.com
BRBrazil
kob.com
USUnited States
kyoceradocumentsolutions.eu
NLNetherlands
lacor.es
ESSpain
polsat.pl
PLPoland
terix.com
USUnited States
jaxa.jp
JPJapan
esprinet.com
ITItaly
pellenc.com
FRFrance
hikvision.com
CNChina
irco.com
USUnited States

Frequently asked questions

What is Alp-001 ransomware?

Alp-001 is a ransomware threat group that has claimed 17 victims since its first known activity in March 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Alp-001 attacked?

Alp-001 has claimed 17 victims in our database, representing 0.1% of all tracked ransomware attacks. The most targeted countries are United States, France, Poland, Italy.

Which countries does Alp-001 target?

Alp-001 has attacked organizations in 11 countries. The top targeted countries are: United States, France, Poland, Italy.

Which industries does Alp-001 target?

Alp-001 most frequently targets the Technology, Telecommunication, Manufacturing sectors based on victim disclosures in our database.

Is Alp-001 still active?

Alp-001's most recent victim disclosure in our database was on April 8, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.