Incidents

ALPHV

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware769 leak-site claims, all timeORKL search ↗

Portable threat brief

ALPHV

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

PDF export is unavailable. The threat brief remains available below; use your browser's Print command.

Executive facts

Actor: ALPHV
Kind: ransomware
Leak-site claims: 769
Catalogued techniques: 0

Scope

Tracked sectors: Manufacturing, Healthcare, Legal, Construction & Engineering, Energy & Utilities
Claim records: 2021-12-18 to 2024-03-03
News stories naming this group: 2024-03-13 to 2026-08-25
Suspected origin: [Unknown]
Motivation: Financial gain
Targeted countries: Worldwide

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Most-claimed sectorsManufacturingHealthcareLegalConstruction & EngineeringEnergy & Utilities

Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records: First observed 2021-12-18Latest observed 2024-03-03
News stories naming this group: First observed 2024-03-13Latest observed 2026-08-25

Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Suspected origin: [Unknown]
Motivation: Financial gain
Targeted countries: Worldwide

Attributed by ETDA Threat Group Cards (Source last updated: 2026-09-23 03:17 UTC), by an exact name or alias match.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand

769 on this site

ipmaltamiraUnclassified2024-03-03source ↗
Ewig UsaUnclassified2024-03-03source ↗
SBM & Co [You have 48 hours. Check your e-mail]Business & Professional Services2024-03-02source ↗
SBM & CoUnclassified2024-03-01source ↗
Petrus Resources Ltd.Energy & Utilities2024-03-01source ↗
Kumagai Gumi GroupConstruction & Engineering2024-03-01source ↗
Allan Berger & AssociatesLegal2024-02-29source ↗
Change Healthcare - Optum - UnitedHealthHealthcare2024-02-28source ↗
verbraucherzentrale hessenUnclassified2024-02-28source ↗
Electro MarteixUnclassified2024-02-27source ↗

View all on Breaches →

Leak-site claim activity

0 additional claims without a disclosure date

2021-122024-03

News stories naming this group

10 on this site

2026-08-25ransomwareMexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense
2026-07-10ransomwareRyuk operator pleads guilty; Blackcat/AlphV conspirator gets nearly 6-year sentence
2026-07-10ransomwareFormer DigitalMint ransomware negotiator who duped clients sentenced to 70 months in jail
2026-04-15ransomwareThe German Cyber Criminal Überfall: Shifts in Europe's Data Leak Landscape
2026-03-16ransomwareRansomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
2026-02-03ai securityFrom Alert Fatigue to Agentic Response: How Workflows and Agent Builder Close the Loop
2025-12-30ransomwareTwo Americans Plead Guilty to Targeting Multiple U.S. Victims Using ALPHV BlackCat Ransomware
2025-09-10ransomwareEmerging Threat Actor: Interlock Ransomware
2025-06-05threat intelScattered Spider Targets Tech Companies for Help-Desk Exploitation
2024-03-13ransomwareUsing Backup Utilities for Data Exfiltration | Huntress

Ransomware claim data is unverified: RansomLook (CC BY 4.0).