alphalocker

T1190Exploit Public-Facing Application

Exploitation of vulnerabilities in public-facing applications and lack of software maintenance or patching as an entry vector.

T1566Phishing

Use of phishing emails to compromise the target system, typically containing malicious attachments or links.

T1020Automated Exfiltration; Exfiltration Over Web Service

The group employs a double extortion tactic, exfiltrating data automatically and/or via web services before encryption, threatening to leak the data if ransom is not paid.

T1486Data Encrypted for Impact

Core ransomware action where victim files are encrypted for extortion purposes.