HackerFeeds
All ransomware groups

alphalocker

31 tracked victims
·first seen 2024-01-24·last activity 2026-02-28

Activity analysis

HackerFeeds has tracked 31 victims claimed by alphalocker since January 2024, most recently in February 2026 — ranking #144 of 332 groups (0.1% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in February 2026. Its most-targeted sector is Business Services (7 victims), followed by Technology (5). The United States accounts for 11 victims (35% of those with a known location).

Victims per year

  • 202417
  • 202513
  • 20261

Top sectors

  • Business Services7
  • Technology5
  • Manufacturing5
  • Healthcare4
  • Energy3
  • Transportation/Logistics2

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

AlphaLocker is a low-cost ransomware operation built on the EDA2 open-source project that sells affiliates an admin panel, ransomware executable, and decryption key generator, lowering the barrier for entry-level cybercriminals using double-extortion tactics.

MITRE ATT&CK TTPs

TA0001

Initial Access

  • T1190Exploit Public-Facing Application

    Exploitation of vulnerabilities in public-facing applications and lack of software maintenance or patching as an entry vector.

  • T1566Phishing

    Use of phishing emails to compromise the target system, typically containing malicious attachments or links.

TA0010

Exfiltration

  • T1020Automated Exfiltration; Exfiltration Over Web Service

    The group employs a double extortion tactic, exfiltrating data automatically and/or via web services before encryption, threatening to leak the data if ransom is not paid.

TA0040

Impact

  • T1486Data Encrypted for Impact

    Core ransomware action where victim files are encrypted for extortion purposes.

Recent victims

No victims tracked yet.