Skip to main content
Darkfield

Operator dossier

Alphalocker (also tracked as Alpha Ransomware) is a ransomware operator currently active on public leak sites. Darkfield has indexed 61 public victims claimed by this operator between January 24, 2024 and May 30, 2026. Alphalocker is a relatively new ransomware group that emerged in January 2024, operating with apparent financial motivations based on their targeting patterns across multiple sectors and countries. The group's origin and affiliations remain unclear due to limited public documentation from major threat intelligence sources, though their global targeting suggests a sophisticated operation. With 31 documented victims primarily concentrated in the United States, United Kingdom, Thailand, Brazil, and Italy, Alphalocker appears to focus on business services, technology, manufacturing, and healthcare sectors, indicating they likely seek targets with both valuable data and the financial capacity to pay ransoms. The group's attack methodology, encryption techniques, and specific tactics have not been extensively documented by major security researchers or government agencies, suggesting either operational security measures that limit visibility into their methods or their relative novelty in the threat landscape. Given the limited public reporting on notable campaigns or high-profile attacks, Alphalocker appears to operate below the radar of major law enforcement initiatives that typically target more established ransomware operations. The group remains active as of available intelligence, though the lack of comprehensive public analysis from established threat intelligence firms suggests they may be a smaller-scale operation or one that has successfully maintained a lower profile compared to more notorious ransomware families.

Most-targeted sectors

Most-affected countries

Recent disclosures by Alphalocker

All 61 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Alphalocker →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Alphalocker

aka Alpha Ransomware · 61 victims indexed · first seen 2 years ago · last activity 2 months ago

61
Victims indexed
#99 of 364 tracked operators
2y 4m
Active period
Jan 2024 → May 2026
10
Countries hit
top United States · 11

At a glance

Status
active
Aliases
Alpha Ransomware
First seen
2 years ago
Last activity
2 months ago
Onion sites
2 known endpoints
Primary sector
Not Found · 6 hits

About

Alphalocker is a relatively new ransomware group that emerged in January 2024, operating with apparent financial motivations based on their targeting patterns across multiple sectors and countries. The group's origin and affiliations remain unclear due to limited public documentation from major threat intelligence sources, though their global targeting suggests a sophisticated operation. With 31 documented victims primarily concentrated in the United States, United Kingdom, Thailand, Brazil, and Italy, Alphalocker appears to focus on business services, technology, manufacturing, and healthcare sectors, indicating they likely seek targets with both valuable data and the financial capacity to pay ransoms. The group's attack methodology, encryption techniques, and specific tactics have not been extensively documented by major security researchers or government agencies, suggesting either operational security measures that limit visibility into their methods or their relative novelty in the threat landscape. Given the limited public reporting on notable campaigns or high-profile attacks, Alphalocker appears to operate below the radar of major law enforcement initiatives that typically target more established ransomware operations. The group remains active as of available intelligence, though the lack of comprehensive public analysis from established threat intelligence firms suggests they may be a smaller-scale operation or one that has successfully maintained a lower profile compared to more notorious ransomware families.

References

3 links

External sources curated by the MISP threat-intel community.

Timeline

9 months
2024-01-01T00:00:00+00:00 · 72024-02-01T00:00:00+00:00 · 12024-03-01T00:00:00+00:00 · 12024-04-01T00:00:00+00:00 · 22024-08-01T00:00:00+00:00 · 62025-09-01T00:00:00+00:00 · 52025-10-01T00:00:00+00:00 · 42025-11-01T00:00:00+00:00 · 42026-02-01T00:00:00+00:00 · 1
2024-01-01T00:00:00+00:002026-02-01T00:00:00+00:00

Top countries

🇺🇸 United States
11
🇬🇧 United Kingdom
3
🇹🇭 Thailand
2
🇧🇷 Brazil
2
🇮🇹 Italy
2
🇫🇷 France
1
🇩🇪 Germany
1
🇹🇼 Taiwan
1
United States dossier →United Kingdom dossier →Thailand dossier →Brazil dossier →

Top sectors

Business Services
6
Technology
5
Manufacturing
4
Healthcare
4
Energy
3
Transportation/Logistics
2
Financial Services
1
Business Services dossier →Technology dossier →Manufacturing dossier →Healthcare dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://mydatae2d63il5oaxxangwnid5loq2qmtsol2ozr6vtb7yfm5ypzo6id.onion
  • http://mydatae2d63il5oaxxangwnid5loq2qmtsol2ozr6vtb7yfm5ypzo6id.onion/blog

Source

Updated 2 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Alphalocker posts a victim.

Add Alphalocker to your watchlist — Pro pings you within 5 minutes of any new Alphalocker leak-site post, Telegram callout, or affiliate-rebrand inference.