NPD4n6: Nicks DFIR blog

Chaos today.

FBI successfully takes down and seized the ALPHV website, to which ALPHV unseized the website and made claims of unleashing affiliates to US entities (including CIS – hospitals, nuclear power etc.). Current status of the seizure is unknown.

Part of this collective LE effort is that the FBI has developed a decryption tool that allowed FBI field offices across the country and law enforcement partners around the world to offer over 500 affected victims the capability to restore their systems: https://www.justice.gov/opa/pr/justice-department-disrupts-prolific-alphvblackcat-ransomware-variant

In other news, Kingdom Market was seized by German authorities. The German authorities also notified individuals of the domain seizure with Kingdom Marketplaces administrators PGP key.

Lots of movement leading up into the new year…