When the FBI offers a decryptor: what ALPHV’s takedown asked of public agencies

The week

On December 19, 2023, the Justice Department announced a disruption campaign against the ALPHV ransomware group, also known as BlackCat, which it described as one of the most prolific ransomware operations in the world. The FBI had gained access to the group’s network, developed a decryption tool and offered it to more than 500 victims; the department said this spared victims ransom demands totaling about $68 million. Agents also seized the group’s leak site. Within hours ALPHV posted a notice claiming to have taken the site back and said it would drop its stated restrictions on affiliates, including on attacking hospitals and other critical infrastructure. The same week, on December 18, the SEC’s requirement for public companies to disclose material cybersecurity incidents on Form 8-K took effect.

An earlier article in this series, on the FBI’s takedown of Hive in January 2023, made the case that removing one ransomware brand leaves the affiliates, the techniques and the victim’s own weaknesses in place. The ALPHV operation confirmed it within hours, when the group announced it was back and loosening its rules. This article takes a narrower and more practical question raised by both operations. In each, the FBI had covert access for months and quietly provided decryption help to victims, some of whom heard about it first from an agent. State and local agencies, school districts and public health departments are frequent ransomware targets, and few incident response plans say what to do when that help arrives. Accepting it well involves three distinct tasks, in the order they arise: confirming the offer, using the tool, and keeping legal duties on their own clock.

Confirming the offer

An unexpected contact from someone claiming to be a federal agent, in the middle of an incident, is exactly the kind of approach criminals imitate. Agencies should verify any such contact through a channel they already trust: the FBI field office’s published number, the agency’s existing contact there, or the state fusion center. That is far easier when the relationship exists before the incident. An agency that has met its field office’s cyber squad, knows the name of a special agent, and has recorded those details in its offline incident binder can confirm an offer in minutes.

The plan should also name who is authorized to speak with law enforcement for the agency, and what they may share. Investigators will ask for logs, malware samples and indicators. Counsel should agree in advance what can be shared without delay. That matters most where systems hold criminal justice information under CJIS policy, federal tax information or health data, each with its own handling rules.

Local agencies rarely respond alone. A county may be supported by the state chief information security officer’s team, a state National Guard cyber unit, a regional information sharing center and its insurer’s incident response firm at the same time. Each may receive information from the FBI. The incident plan should name one coordinator who receives offers of help, logs them, and decides who acts on each, so that a decryptor is not run twice by different teams or not at all.

Using the tool

A decryptor developed by law enforcement is a recovery tool of unknown quality in the agency’s specific environment. It may work perfectly, partially, or slowly. Running it carelessly can damage the files it is meant to recover. The safe procedure is the same one incident responders apply to any decryptor: preserve forensic images of affected systems first, test the tool on copies, check the integrity of decrypted data against backups or application checks, and only then run it at scale. That work usually needs outside incident response help, which is why a retainer arranged in advance matters.

Decryption also answers only one question. It restores data. It does not remove the attacker’s accounts, scheduled tasks or remote access tools, and it does not close the hole they came through. Systems decrypted in place may still be compromised. Most agencies should treat a decryptor as a way to recover data that their backups lack, starting with the systems whose data cannot be reconstructed any other way, such as records created since the last good backup,, and rebuild the systems themselves from known-good images. A recovery plan that assumes no decryptor will ever arrive, built on offline tested backups and documented rebuild procedures, is also the plan that uses one best when it does.

Keeping legal duties on their own clock

Law enforcement involvement can change some timelines and leave others untouched. Some notification regimes allow delay at law enforcement’s request, and the SEC rule for public companies included a narrow mechanism for national security or public safety delays. Most state breach notification laws turn on the theft or acquisition of personal information. Decryption does nothing about data the attackers already took, and ALPHV, like most groups, stole data before encrypting it.

An agency should therefore run its breach assessment in parallel with recovery, from the first day. Its counsel should confirm which notification duties apply under state law and sector rules, whether any law enforcement delay request is in writing and what it covers, and how cooperation affects public statements. Cyber insurers, where the agency has coverage, usually require prompt notice and approval of vendors, and a free decryptor does not suspend those terms. Communications staff need a line that acknowledges cooperation with law enforcement without describing an investigation the agency does not control.

These three tasks fit on a single page of an incident plan, and that page is worth writing. A takedown is the best case for a victim. Agencies that have the contacts, the technical procedure and the legal checklist ready get the full benefit of it.

With hindsight

ALPHV’s return was brief and damaging. Its affiliates attacked Change Healthcare in February 2024, causing one of the most disruptive cyber incidents in U.S. healthcare history. That month the State Department offered rewards of up to $10 million for information on the group’s leaders. In early March the group appeared to vanish in what researchers widely described as an exit scam, after an affiliate complained of not being paid its share of a large ransom. Its affiliates moved to other operations. In February 2024 an international operation also disrupted LockBit and made decryption keys available to victims, again through law enforcement channels. Ransomware against state and local government continued through 2025. Takedowns and decryption offers became a recurring feature of the landscape rather than a one-off, which made the single page described above more useful, not less.