{"id":11566,"date":"2026-03-24T10:03:38","date_gmt":"2026-03-24T10:03:38","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/24\/new-data-leak-site-uncovered-linked-to-active-initial-access-broker-on-underground-forums\/"},"modified":"2026-03-24T10:03:38","modified_gmt":"2026-03-24T10:03:38","slug":"new-data-leak-site-uncovered-linked-to-active-initial-access-broker-on-underground-forums","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/24\/new-data-leak-site-uncovered-linked-to-active-initial-access-broker-on-underground-forums\/","title":{"rendered":"New Data Leak Site Uncovered Linked to Active Initial Access Broker on Underground Forums"},"content":{"rendered":"

New Data Leak Site Uncovered Linked to Active Initial Access Broker on Underground Forums
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The underground cybercriminal world saw a notable development on March 22, 2026, when a new Tor-based leak site called \u201cALP-001\u201d appeared on the dark web, openly marketing itself as a \u201cData Leaks \/ Access Market.\u201d <\/p>\n

The emergence of this platform points to a growing trend where established threat actors who traditionally sell corporate network access are now pushing into full-scale extortion. <\/p>\n

Security researchers warn this could represent a significant shift in how initial access brokers operate, merging data theft with victim exposure for maximum leverage.<\/a><\/p>\n

ALP-001 did not appear out of nowhere. The site carries clear markers of a well-organised threat actor who has been building a presence across multiple dark web forums since at least July 2024. <\/p>\n

During that time, the group was primarily known for selling unauthorised access to compromised enterprise systems, with a particular focus on internet-facing perimeter devices and remote access gateways. <\/p>\n

This move marks a sharp escalation in intent, suggesting the group now views extortion as a core part of its operation.<\/a><\/p>\n

ReliaQuest analysts identified ALP-001<\/a> and directly tied the group to an active Initial Access Broker operating across prominent underground forums, including Exploit and DarkForums. <\/p>\n

By cross-referencing the Tox and Session IDs displayed on the leak site, researchers confirmed that the same contact identifiers were already being used by a known IAB forum account. <\/p>\n

This group had previously gone by the names \u201cAlpha Group\u201d and \u201cDGJT Group,\u201d giving investigators enough historical data to construct a timeline of activity reaching back almost two years.<\/a><\/p>\n

\n
\n
\n
\n

\"\ud83d\udea8\" Unmasking the new data leak site: ALP-001<\/p>\n

A new Tor-based leak site, “ALP-001,” surfaced yesterday marketing itself as a “Data Leaks \/ Access Market.” But who are they?<\/p>\n

ReliaQuest directly tied this group to an active Initial Access Broker (IAB) on underground forums. \"\ud83d\udc47\"\u2026 pic.twitter.com\/f1uyjM3Yl4<\/a><\/p>\n

\u2014 ReliaQuest Threat Research (@ReliaQuestTR) March 23, 2026<\/a>\n<\/p><\/blockquote>\n