The FBI, the UK, Denmark, Germany, Spain, and Australia seize ransomware gang ALPHV's dark web leak website; the US also seized “several websites” run by ALPHV
An international group of law enforcement agencies have seized the dark web leak site of the notorious ransomware gang known as ALPHV, or BlackCat.
Context & Ripple Effects
This operation extends a run of cross-border ransomware takedowns: agencies previously seized Hive’s website and obtained decryption keys, then moved against RagnarLocker’s portal in a separate international portal seizure.
It matters because ALPHV’s leak site was part of the public-pressure mechanism behind ransomware extortion. The action shows the same multinational model being applied to another major operation’s visible infrastructure.
First-order effects
- ALPHV loses a public channel used to expose or threaten to expose victim data, while the US seizure of additional sites further interrupts its web presence.
- Victims facing ALPHV-related extortion may get temporary relief from the immediate threat of publication through the seized leak site.
Second-order effects
- Other ransomware operators are likely to treat publicly reachable leak portals as more exposed infrastructure and shift or duplicate those services, raising their operational overhead.
- The participating agencies gain another practical template for coordinated infrastructure seizures, building on the Hive disruption that also yielded decryption keys.
Third-order effects
- If repeated, these actions can make ransomware operations more dependent on replaceable, distributed infrastructure rather than stable public-facing brands and portals.
- The pattern favors persistent multinational disruption over one-off arrests: seizures can constrain extortion operations, but their durability depends on whether investigators can continue reaching operators and their replacement infrastructure.
The trend: Ransomware enforcement is increasingly targeting the infrastructure that enables extortion and publicity through recurring cross-border operations.