Alpha Ransomware: How to Handle the New Cyber Threat 

Alpha ransomware is a new player in the cyber threat field. The threat actors responsible for this malware are still developing and improving their creation, and these changes are notable on their ransom message and leakage websites.

Even though Alpha ransomware is reportedly not as prolific as other threats, businesses must take measures to protect themselves from it as they do against the most common cyber threats.

SalvageData experts recommend proactive data security measures, such as regular backups, strong cybersecurity practices, and keeping software up to date, to protect against malware attacks. And, in case of a cyber attack, contact our malware recovery experts immediately.

What is Alpha ransomware

Alpha ransomware is a malware variant that emerged in May 2023, targeting victims primarily through email spam messages containing infected attachments. It encrypts various file formats on the victim’s computer, appending a random 8-character alphanumeric extension to encrypted files. 

The ransomware has evolved its tactics over time, as seen in the revisions of its ransom notes in May and November 2023, reflecting branding efforts and refinement. 

Alpha threat actors operate a Dedicated/Data Leak Site (DLS) on the Dark Web, titled “MYDATA,” and has listed nine victims from different industry sectors, including electrical, retail, biochemical, apparel, health, and real estate. 

Potential connection to Netwalker ransomware

Security researchers have identified potential links between Alpha ransomware and the defunct Netwalker operation. Similarities include the use of a similar PowerShell-based loader, significant code overlap in the payload, and matching elements in their payment portals. 

Both Alpha and Netwalker also delete themselves after encryption using a temporary batch file. However, it remains unclear whether Alpha represents a rebranded Netwalker or a new group using its code.

Everything we know about Alpha ransomware

Confirmed Name

• Alpha Ransomware

Alpha ransomware decryptor

• As of the time of this article’s publication, there’s no public Alpha ransomware decryptor.

Threat Type

• Ransomware
• Crypto virus
• Files locker
• Data leak

Encryption file extension

• Appends a random 8-character alphanumeric extension to encrypted files

Ransom note file name

• README HOW TO DECRYPT YOUR FILES.TXT
• README HOW TO DECRYPT YOUR FILES.HTML

Detection names

• Avast Win64:MalwareX-gen [Trj]
• Emsisoft Trojan.GenericKD.68265615 (B)
• Kaspersky Trojan.Win32.Cobalt.qqn
• Malwarebytes Malware.AI.403629929
• Microsoft Trojan:Win64/CobaltStrike.LKH!MTB
• Sophos Mal/Generic-S

Distribution methods

• Phishing emails
• Exploit kits
• Peer-to-peer networks
• Trojans
• Fake software updaters

Alpha ransomware methods of infection and execution

Alpha ransomware, distinct from ALPHV ransomware, currently exhibits lower infection rates compared to its competitors, like Lockbit, Malas, and Cl0p.

The evolution of Alpha ransomware’s ransom note is notable. Initially, their ransom note lacked a compelling tone, simply stating that data had been stolen and encrypted, and offering assistance in restoring the system and decrypting some files for free. With subsequent victims, the note became more concise, introducing the group as “Alpha Locker” and reiterating instructions for contacting them for assistance.

Initial access and evade detection 

Alpha ransomware gains initial access to a victim’s system mainly through email spam messages containing infected attachments. 

These attachments may be in the form of .WSF and .DOC files, which, when opened, prompt users to enable macro commands. Enabling these macros triggers the execution of the ransomware, initiating the encryption process on the victim’s files.

Similar to many other ransomware groups, Alpha utilizes readily available tools like Taskkill, PsExec, Net.exe, and Reg.exe to evade detection.

Payload deployment and encryption

Upon execution, Alpha ransomware starts encrypting various file formats stored on the victim’s computer. It utilizes an asymmetric encryption algorithm to encrypt files, adding a .bin extension to each encrypted file’s name. The private key necessary for decryption is stored on remote servers controlled by the cybercriminals, making decryption without their intervention impossible.

Ransom note drop-off

After encrypting the files, Alpha ransomware drops ransom notes in the form of README HOW TO DECRYPT YOUR FILES.TXT and README HOW TO DECRYPT YOUR FILES.HTML files. These notes are placed in each folder containing the encrypted files. 

The ransom notes contain instructions for victims on how to make contact with the cybercriminals, usually via a TOX messenger, and provide information on purchasing the decryption tool. 

It changes as the threat actors keep working on their malware, having three known versions until the time of this article’s publication.

Here’s an example of the ransom note from November 2023:

Do not pay the ransom! Contacting a ransomware recovery service can not only restore your files but also remove any potential threat.

Alpha ransomware Indicators of Compromise (IOCs)

Indicators of Compromise (IOCs) are artifacts observed on a network or in an operating system that indicate a computer intrusion with high confidence. IOCs can be used for early detection of future attack attempts using intrusion detection systems and antivirus software.

They are essentially digital versions of evidence left at a crime scene, and potential IOCs include unusual network traffic, privileged user logins from foreign countries, strange DNS requests, system file changes, and more. When an IOC is detected, security teams evaluate possible threats or validate its authenticity. IOCs also provide evidence of what an attacker had access to if they did infiltrate the network.

How to handle an Alpha ransomware attack

The first step to recovering from an Alpha ransomware attack is to isolate the infected computer by disconnecting it from the internet and removing any connected device. Then, you must contact local authorities. In the case of US residents and businesses, it is the FBI and the Internet Crime Complaint Centre (IC3).

To report a malware attack you must gather every information you can about it, including:

• Screenshots of the ransom note
• Communications with threat actors (if you have them)
• A sample of an encrypted file

However, if you prefer to contact professionals, then it’s best to leave every infected machine the way it is and ask for an emergency ransomware removal service. These professionals are equipped to quickly mitigate the damage, gather evidence, potentially reverse the encryption, and restore the system.

Restarting or shutting down the system may compromise the recovery service. Capturing the RAM of a live system may help get the encryption key, and catching a dropper file, i.e. file executing the malicious payload, might be reverse-engineered and lead to decryption of the data or understanding how it operates.

You must not delete the ransomware, and keep every evidence of the attack. That’s important for digital forensics experts to trace back to the hacker group and identify them. It is by using the data on your infected system that authorities can investigate the attack. A cyber attack investigation is not different from any other criminal investigation: it needs evidence to find the attackers.

1. Contact your Incident Response provider

A Cyber Incident Response is the process of responding to and managing a cybersecurity incident. An Incident Response Retainer is a service agreement with a cybersecurity provider that allows organizations to get external help with cybersecurity incidents. It provides organizations with a structured form of expertise and support through a security partner, enabling them to respond quickly and effectively during a cyber incident. 

An incident response retainer offers peace of mind to organizations, offering expert support before and in the aftermath of a cybersecurity incident. An incident response retainer’s specific nature and structure will vary according to the provider and the organization’s requirements. A good incident response retainer should be robust but flexible, providing proven services to enhance an organization’s long-term security posture.

If you contact your IR service provider, they can take over immediately and guide you through every step in the ransomware recovery. However, if you decide to remove the malware yourself and recover the files with your IT team, then you can follow the next steps.

2. Use a backup to restore the data

The importance of backup for data recovery cannot be overstated, especially in the context of various potential risks and threats to data integrity. 

Backups are a critical component of a comprehensive data protection strategy. They provide a means to recover from a variety of threats, ensuring the continuity of operations and preserving valuable information. In the face of ransomware attacks, where malicious software encrypts your data and demands payment for its release, having a backup allows you to restore your information without succumbing to the attacker’s demands.

Make sure to regularly test and update your backup procedures to enhance their effectiveness in safeguarding against potential data loss scenarios. There are several ways to make a backup, so you must choose the right backup medium and have at least one copy of your data stored offsite and offline.

3. Contact a malware recovery service

If you don’t have a backup or need help removing the malware and eliminating vulnerabilities, contact a data recovery service. Paying the ransom does not guarantee your data will be returned to you. The only guaranteed way to restore every file is if you have a backup. If you don’t, ransomware data recovery services can help you decrypt and recover the files.

SalvageData experts can safely restore your files and prevent Alpha ransomware from attacking your network again, contact our recovery experts 24/7.

Prevent the Alpha ransomware attack

Preventing malware is the best solution for data security. is easier and cheaper than recovering from them. Alpha Ransomware can cost your business’s future and even close its doors. 

These are a few tips to ensure you can avoid malware attacks:

• Keep your operating system and software up-to-date with the latest security patches and updates. This can help prevent vulnerabilities that can be exploited by attackers.
• Use strong and unique passwords for all accounts and enable two-factor authentication whenever possible. This can help prevent attackers from gaining access to your accounts.
• Be cautious of suspicious emails, links, and attachments. Do not open emails or click on links or attachments from unknown or suspicious sources.
• Use reputable antivirus and anti-malware software and keep it up-to-date. This can help detect and remove malware before it can cause damage.
• Use a firewall to block unauthorized access to your network and systems.
• Network segmentation to divide a larger network into smaller sub-networks with limited interconnectivity between them. It restricts attacker lateral movement and prevents unauthorized users from accessing the organization’s intellectual property and data.
• Limit user privileges to prevent attackers from gaining access to sensitive data and systems.
• Educate employees and staff on how to recognize and avoid phishing emails and other social engineering attacks.