New Leak Site Tied to Active Initial Access Broker Emerges on Underground Forums

ALP-001 is a Tor-only leak site run by an Initial Access Broker that appears to be evolving into a data-extortion operation: it publicly listed French manufacturer Pellenc (≈543M revenue, ~228 GB claimed data) and set an early-April 2026 payment deadline. Researchers link the site to established forum aliases via reused contact IDs and prior access listings; the report highlights commonly abused edge services (exposed SSH, Fortinet/Cisco/Citrix/GlobalProtect) and recommends immediate patching, MFA enforcement, privileged account audits, and underground forum monitoring.