ALP-001 emerged very recently. Is this a completely new group, or a rebrand of an old group?

The ALP-001 group is a new group, with new attacks and new working methods to gain access to the networks of large companies.

Your website presents ALP-001 both as a leak platform and as a marketplace for selling access. What is your main business model today — ransomware attacks, data extortion only, initial access sales, or a bit of everything?

Our website is not only intended for leaks. We also have exploits and 0days, as well as access to large companies. We can sell access to anyone. If our victims pay, then we do not sell anything.

What is your main entry vector into organizations? Do you purchase stolen credentials, exploit vulnerabilities, or use something else?

We do not buy access. We develop our exploits ourselves.

Do you work with affiliates, or is the group a closed team? And if you do work with others, how do you vet them and reduce the risk of scams or law enforcement infiltration?

We do not work with anyone. We work alone. If we bring in partners, it is only with parties we trust.

How do you decide whether a certain target is worth attacking? Which factors matter most to you?

Target selection is a calculated business decision. The main factors include financial potential, such as revenue and insurance, the sensitivity of the data, ease of extortion, legal risk by geographic region, and our assessment of the organization's ability or willingness to pay. A low level of security is a key factor.

You published victims, but did not show proof of breach and did not disclose the ransom amount demanded. Why?

We have just added a timer for publishing samples and files. This applies both to the victim, when they contact us, and to the public, after 8 hours.

Regarding Hikvision — this is a large and prominent company. Can you share more about this case? What type of access did you obtain, what kind of information do you claim was taken, how long were you inside the network, and why did you decide to target this organization specifically?

We obtained significant access to the network using a combination of several methods. We extracted large amounts of information, including internal documents, project files, and certain employee information. We were inside their network for an extended period in order to properly map their infrastructure, around five months. They were selected because of their size, their global profile, and the sensitive nature of their field of activity. They are a high-value target with significant payment potential.

Another question related to Hikvision — did the company's size and profile change your strategy in any way? For example, negotiation, deadline, and so on.

Absolutely. When dealing with a target of this profile, our strategy becomes more patient. The ransom demand is, of course, adjusted to the company's size, and the negotiation timeline may be extended. We apply pressure more carefully in order not to trigger an unusual law enforcement response. The decision not to publish proof of breach to everyone is part of our pressure strategy.

Every person, even if they chose an unconventional path, draws inspiration from somewhere. Is there a specific book, person, or movie that shaped your worldview or influenced the way you operate?

Inspiration comes from different principles and from technological reality. We study the successes and failures of those who came before us, not in order to imitate, but in order to evolve.

Anything final you would like to share with the channel's followers?

Defenses are static, while the attack is adapted to each organization. To the organizations watching us, your information is only as secure as your weakest link, and we are in the business of finding it. To others operating in this arena, innovate or become irrelevant. This is not a game, it is a market. Act accordingly.