{ "id": "023b305e-02c9-44b3-9352-24b1e143d26a", "created_at": "2026-04-06T00:15:55.93298Z", "updated_at": "2026-04-10T13:12:50.801045Z", "deleted_at": null, "sha1_hash": "d083ae9412a7f2727825d3e1c0f8915d8d55aeaa", "title": "US offers up to $15 million for tips on ALPHV ransomware gang", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 3892565, "plain_text": "US offers up to $15 million for tips on ALPHV ransomware gang\r\nBy Sergiu Gatlan\r\nPublished: 2024-02-15 · Archived: 2026-04-05 12:37:31 UTC\r\nThe U.S. State Department is offering rewards of up to $10 million for information that could lead to the identification or\r\nlocation of ALPHV/Blackcat ransomware gang leaders.\r\nAn additional $5 million bounty is also available for tips on individuals trying to take part in ALPHV ransomware attacks,\r\nlikely to discourage affiliates and initial access brokers.\r\nThe FBI linked this ransomware gang to over 60 breaches worldwide during its first four months of activity between\r\nNovember 2021 and March 2022.\r\nhttps://www.bleepingcomputer.com/news/security/us-offers-up-to-15-million-for-tips-on-alphv-ransomware-gang/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/us-offers-up-to-15-million-for-tips-on-alphv-ransomware-gang/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nALPHV has also raked in at least $300 million in ransom payments from more than 1,000 victims until September 2023,\r\naccording to the FBI.\r\n\"The U.S. Department of State is offering a reward of up to $10,000,000 for information leading to the identification or\r\nlocation of any individual(s) who hold a key leadership position in the Transnational Organized Crime group behind the\r\nALPHV/Blackcat ransomware variant,\" the State Department said.\r\n\"In addition, a reward offer of up to $5,000,000 is offered for information leading to the arrest and/or conviction in any\r\ncountry of any individual conspiring to participate in or attempting to participate in ALPHV/Blackcat ransomware\r\nactivities.\"\r\nThese rewards are provided through the U.S. Transnational Organized Crime Rewards Program (TOCRP), with more than\r\n$135 million paid for helpful tips since 1986.\r\nThe State Department has set up a dedicated Tor SecureDrop server that can be used to submit tips on ALPHV and other\r\nwanted threat actors.\r\nState Department Secure Drop Tor page (BleepingComputer)\r\nRansomware and pipelines\r\nALPHV surfaced in November 2021 and is believed to be a rebrand of the DarkSide and BlackMatter ransomware\r\noperations.\r\nThe operation shut down in May 2021 after extensive investigations by law enforcement led to the seizure of their\r\ninfrastructure following the Colonial Pipeline attack.\r\nThe gang re-emerged under the BlackMatter brand, shut down again in November 2021, and returned as ALPHV/BlackCat\r\nin February 2022.\r\nThe FBI disrupted ALPHV's operation in December after breaching the group's servers and temporarily taking down its Tor\r\nnegotiation and leak sites after creating a decryption tool following months of monitoring their activities.\r\nThe ransomware gang recently added Canada's Trans-Northern Pipelines to its new leak website, with the company now\r\ninvestigating ALPHV's claims after confirming a November 2023 network breach.\r\nIn January, the U.S. government also announced rewards of up to $10 million for information on the leaders of the Hive\r\nransomware gang.\r\nThe State Department previously announced bounties of up to $15 million for tips on members and affiliates of the Hive,\r\nClop, Conti [1, 2], REvil (Sodinokibi), and Darkside ransomware operations.\r\nhttps://www.bleepingcomputer.com/news/security/us-offers-up-to-15-million-for-tips-on-alphv-ransomware-gang/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/us-offers-up-to-15-million-for-tips-on-alphv-ransomware-gang/\r\nhttps://www.bleepingcomputer.com/news/security/us-offers-up-to-15-million-for-tips-on-alphv-ransomware-gang/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://www.bleepingcomputer.com/news/security/us-offers-up-to-15-million-for-tips-on-alphv-ransomware-gang/" ], "report_names": [ "us-offers-up-to-15-million-for-tips-on-alphv-ransomware-gang" ], "threat_actors": [ { "id": "d90307b6-14a9-4d0b-9156-89e453d6eb13", "created_at": "2022-10-25T16:07:23.773944Z", "updated_at": "2026-04-10T02:00:04.746188Z", "deleted_at": null, "main_name": "Lead", "aliases": [ "Casper", "TG-3279" ], "source_name": "ETDA:Lead", "tools": [ "Agentemis", "BleDoor", "Cobalt Strike", "CobaltStrike", "RbDoor", "RibDoor", "Winnti", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "6e23ce43-e1ab-46e3-9f80-76fccf77682b", "created_at": "2022-10-25T16:07:23.303713Z", "updated_at": "2026-04-10T02:00:04.530417Z", "deleted_at": null, "main_name": "ALPHV", "aliases": [ "ALPHV", "ALPHVM", "Ambitious Scorpius", "BlackCat Gang", "UNC4466" ], "source_name": "ETDA:ALPHV", "tools": [ "ALPHV", "ALPHVM", "BlackCat", "GO Simple Tunnel", "GOST", "Impacket", "LaZagne", "MEGAsync", "Mimikatz", "Munchkin", "Noberus", "PsExec", "Remcom", "RemoteCommandExecution", "WebBrowserPassView" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434555, "ts_updated_at": 1775826770, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/d083ae9412a7f2727825d3e1c0f8915d8d55aeaa.pdf", "text": "https://archive.orkl.eu/d083ae9412a7f2727825d3e1c0f8915d8d55aeaa.txt", "img": "https://archive.orkl.eu/d083ae9412a7f2727825d3e1c0f8915d8d55aeaa.jpg" } }