Cyber Threat Actor: AlphaV
| Actor Type | Location | Known Incidents |
Criminal
|
United Arab Emirates
|
2 incidents |
|---|
Profile
AlphaV is a threat actor thatoperates under the alias AlphaV Group. Open source indicators associate the actor with the United Arab Emirates as its known location. No additional aliases or geographic details are publicly available beyond those two points. The actor’s name appears consistently as AlphaV or AlphaV Group across the cited sources.
The actor’s observed activity includes a claim of responsibility for a cyber incident targeting Gems Education, the largest education operator in the UAE. According to reporting, AlphaV posted alleged proof of exfiltrated personal data on its dark web leak site following the incident. The posted material reportedly consisted of screenshots of a passport, a birth certificate, and student‑parent details for a single student. Gems Education stated that the attack had minimal impact on its operations and that an investigation was underway. The organization has not confirmed whether any personal or financial data was actually compromised. The activity was reported by cybersecurity news outlets including Databreaches.net. The original report was authored by Alkesh Sharma and published on Databreaches.net on February 25, 2022.
The incident occurred on 2022‑02‑25 and is currently the most detailed publicly reported operation attributed to AlphaV. While the actor asserted possession of sensitive individual records, the victim’s assessment indicates the scope of any data loss remains uncertain. No other campaigns or tooling specifics have been documented in the sources provided. Consequently, the actor’s tactical preferences, malware families, or initial access vectors cannot be derived from the available information. Similarly, no public attribution to a state sponsor or criminal consortium has been made for AlphaV. The profile therefore rests solely on the verified claim of responsibility for the Gems Education incident and the associated location indicator. The actor has not issued any further public statements or communications following the leak site posting.
