[Back to the takedown index](https://takedownindex.org/takedowns)

# ALPHV/BlackCat disruption

December 2023, Ransomware
Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation)

Extended pass entry, last reviewed August 21, 2026

What was taken down?

Leak-site and negotiation infrastructure disrupted; decryption keys/tooling provided to victims.

[See what happened](#what-happened)

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Partial

[See people and accountability](#people)

Did it stay down?

After this action the service returned under the same operators, first seen December 2023. No later seizure of the replacement is recorded. Medium confidence in the link between the two.

[See what happened afterward](#afterward)

## What happened

DOJ/FBI announced a disruption of the ALPHV/BlackCat ransomware-as-a-service operation and offered an FBI-developed decryption capability to more than 500 victims.

**Date:** December 2023

**Target:** ALPHV/BlackCat, ransomware group

**Activity:** Ransomware

**Operational lead:** FBI

**Partners**

DOJ[[1]](#source-1)

- [United States Department of Justice](https://takedownindex.org/organizations/united-states-department-of-justice), prosecuting

**Jurisdiction:** Not established

**Outcome:** Leak-site and negotiation infrastructure disrupted; decryption keys/tooling provided to victims.

**Status:** Completed

**Legal mechanism:** Court-authorized technical operation; federal criminal process.

**Group accounted for:** Partial

## People and accountability

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

No core-operator arrests were announced in the initial disruption; the group reasserted control of some infrastructure shortly afterward.

[See the organizations and roles behind this action](https://takedownindex.org/takedowns/alphv-blackcat-disruption/organizations)

## What happened afterward

After this action the service returned under the same operators, first seen December 2023. No later seizure of the replacement is recorded. Medium confidence in the link between the two.

December 2023

ALPHV/BlackCat infrastructure reassertion. Same operators. Confidence: Medium. No later seizure recorded.[[1]](#source-1)

Group operators reasserted control of some leak-site infrastructure shortly after the FBI's technical disruption.

## Sources

Numbered markers throughout this entry link to the source that supports the claim beside them.

### Official sources

1.
[Justice Department disrupts ALPHV/BlackCat ransomware](https://takedownindex.org/sources/us-doj-justice-department-disrupts-alphv-blackcat-ransomware)

US DOJ, December 19, 2023, Source grade P1

Establishes the FBI's disruption of ALPHV/BlackCat infrastructure and the decryption-key offer.

No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Added from deep-research aggregation pass. Not independently re-verified source-by-source to the same standard as the original 38-incident core; source\_quality capped at S2/P2 pending a dedicated verification pass.

Research context

## How this entry was checked

This entry came from a broader aggregation pass and has not been independently verified source by source. Its sources are graded no higher than P2 or S2, and most carry no address yet. Treat the figures as a research lead rather than a settled record.

Source review: Extended pass, not yet verified

Sources cited: 1

Research cutoff: August 20, 2026

Last reviewed August 21, 2026

See also

[About the Internet Takedown Index](https://takedownindex.org/about)

Related entries

- [Kingdom Market seizure](https://takedownindex.org/takedowns/kingdom-market-seizure)
- [KV Botnet disruption](https://takedownindex.org/takedowns/kv-botnet-disruption)
- [Sinbad cryptocurrency mixer seizure](https://takedownindex.org/takedowns/sinbad-cryptocurrency-mixer-seizure)

Report updates or corrections

Help keep this record accurate.

[Submit feedback](https://takedownindex.org/about#corrections-and-updates)