ALP-001: From Access Broker to Extortion New Tor-Based Threat Emerges A newly identified Tor-based leak site, ALP-001, marks a shift in cybercriminal tactics, transitioning from selling network access to direct extortion. Operating as a "Data Leaks / Access Market," the group blends traditional initial access brokerage (IAB) methods with ransomware-style pressure tactics. First Victim Named: Pellenc ALP-001’s inaugural public target is Pellenc, a French manufacturer of battery-powered agricultural equipment based in Pertuis. The company, with reported revenue of $543 million, faces a 228 GB data leak threat, with a payment deadline set for early April 2026 a classic double-extortion tactic. Attribution & Evolution Threat researchers, including ReliaQuest, link ALP-001 to a long-standing IAB active on forums like Exploit and DarkForums, previously operating under aliases such as "Alpha Group" and "DGJT Group." Overlapping Tox and Session IDs, along with matching victim listings (including Pellenc), confirm the connection. In January 2026, the same broker advertised access to a French industrial firm matching Pellenc’s profile, reinforcing the pivot from access sales to extortion. Tactics & Targets ALP-001 specializes in compromising perimeter technologies, including: - VPN/RDP gateways (Fortinet, Cisco, Citrix RDWeb, Palo Alto GlobalProtect) - Exposed SSH servers - Stolen credentials (via brute force, infostealer logs, or unpatched vulnerabilities) Once inside, the group establishes persistence creating admin accounts or backdoor VPN profiles before monetizing access, now through direct extortion rather than resale. Broader Implications ALP-001’s emergence reflects a growing trend: IABs evolving into standalone extortion groups to maximize profits. While the group has a proven track record in access brokering, its ability to exfiltrate and curate large datasets remains unproven. The Pellenc case suggests an experiment with ransomware-style shaming, though public evidence of widespread data leaks is still limited. For now, ALP-001 operates as a high-quality access broker with escalating extortion ambitions, signaling a potential new threat in the cybercrime ecosystem.