A recent entrant into the ransomware landscape, the Alpha group, has made its mark with the introduction of a Dedicated/Data Leak Site (DLS) on the Dark Web, showcasing an initial compilation of data from six identified victims.
Although Alpha ransomware has only surfaced recently, its activities trace back to May 2023, characterized by a lower infection rate in comparison to its counterparts and a notable absence of active samples available for analysis in the wild.
According to an advisory released by security researchers at Netenrich on Monday, the ransomware employs a random 8-character alphanumeric extension to encrypt files. This evolution, shifting from “random numbers” to an “alphanumeric 8-character” extension in subsequent versions, indicates the group’s ongoing refinement of its approach. Examination of the ransom note pattern unveils the group’s iterative process in crafting messages to its victims over time.
The Alpha ransomware’s Data Leak Site, dubbed “MYDATA,” is identified as unstable and frequently experiences downtime, suggesting the group is still in the process of establishing its operations. The DLS incorporates a victim login prompt offering various functionalities, including INVOICE, CHAT, INFO, TEST DECRYPT, and LOGOUT.
Netenrich’s senior threat analyst, Rakesh Krishnan, elucidated, “DLSs are a strategic fixture, as ransomware groups anticipate that victims, to evade potential reputational damage or other breach-related costs, will be more inclined to pay ransoms due to mandatory disclosures of ‘material’ data breaches.”
Diverse industries, including electrical, retail, biochemical, apparel, health, and real estate, are represented among the victims hailing from the UK, the US, and Israel. Through investigative efforts, the ransomware group’s Bitcoin address, ransom demand, TOX ID, and additional details have been uncovered.
Krishnan pointed out the inconsistent nature of Alpha group’s ransom demands, suggesting a blend of both proficiency and amateurism within the ransomware realm. The security expert anticipates an escalation in victim numbers as the group gains visibility, making headlines and leaving a more pronounced digital footprint.
In Krishnan’s words, “Sustained monitoring and analysis will be crucial to comprehending and mitigating the threat presented by this emerging ransomware variant.”
