Meet the Unique New “Hacking” Group: AlphaLock

It’s not every day that you discover a new Russian hacking group complete with a song and dance routine (performed live), a sleek user interface (with dark mode!) and a clearly thought-out business model. But that is exactly what our security research team discovered with “AlphaLock,” a “pentesting training organization” that trains hackers and then monetizes their services through a dedicated affiliate program.

We originally discovered their group through a public Telegram channel that has since become private. This post will serve as a detailed investigation and description of one of the most brazen, strange, and best marketed cybercrime groups to appear in 2023.

AlphaLock’s Business Model and Launch

One of the most poignant cybercrime trends in 2023 has been the diversification and role specialization that has occurred among criminals. There are detailed and complex supply chains that exist, creating economies of scale for cybercriminals.

AlphaLock serves as one of the first and interesting examples we’ve seen of a threat group trying to create their own end to end pipeline to generate revenue.

Their business model seems to be split into two parts: Bazooka Code Pentest Training and the ALPentest Hacking Marketplace.

AlphaLock Business Model Part One: Bazooka Code Pentest Training

Nobody wants to believe that they are the bad guy, even for threat actors. AlphaLock takes measures to claim that they are simply training “pentesters,” a phenomenon that is familiar to any security researchers familiar with ransomware group messaging and their claims of “pentesting after the fact.”

AlphaLock’s business model seems to be split into two parts. The first part involves training an “army” of hackers through customized online courses.

The threat actors explain in detail on their Telegram channel:

But maybe after reading this you still have reservations.

Can the Bazooka Code course really help you earn a living and justify a $185 dollar expense? AlphaLock has done the math.

“Education prices at Lomonosov Moscow State University vary from 383,550 rubles to 540,000 rubles per year. On average, the cost of education is about 395,375 rubles per year or 197,687 rubles per semester. You will study there for 4 to 6 years – mathematics, physics, cybernetics, chemistry, biology, soil science, geology, geography, medicine, history, philology, philosophy, economics, jurisprudence, journalism, psychology, area studies, sociology, management, politics, and political science, etc.

Let’s take the worst option that is considered good in Russia – 395,475*4 = 1,581,660 rubles to graduate as a journalist. According to GorodRabot, the average salary of a journalist in Russia for the year 2023 is 46,161 rubles. In a month, the salary has changed by 11.4% – from 40,915 to 46,161 rubles. Most often, job vacancies offer a salary of 30,000 rubles (modal).

1,581,660 rubles divided by 40,915 rubles = 38 months, or for 3 years you will be paying back your education at the unfortunate university, without eating anything, owning any property, etc.

The bazookacode course now costs $185 and the training lasts 2 months, you get a team, knowledge, and tools for work, they advise and help you, you learn at speeds, as if in euphoria. The average poor carder in the worst-case scenario earns from $1,000 per month, I’m not even talking about networks and established work, let’s calculate how much time you need to pay back the education if you still managed to set up your own business and work?”

As we said at the top, unique only begins to describe this group.

If the business model only involved selling pentesting courses at $185 though this would be fairly par for the course. However, this represents only stage one of AlphaLock’s plans.

The next step involves the dark web forum XSS, and an affiliate program where we suspect they plan to make the majority of their profits.

AlphaLock Business Model Part Two: The ALPentest Hacking Marketplace

The second part of this business scheme is a direct corollary to the first – use the newly trained hackers to create a marketplace where threat actors can purchase “pentesting services” targeted at a specific organization.

Below is a screenshot from their recently released dance video announcing the creation of the AlphaLock affiliate program:

Bazooka Code explains:

Bazooka Code shared screenshots of the “beta” version of the new hacking marketplace. Threat actors will be able to list targets that they want to “pentest” and other threat actors can then attack the companies, post proof, and collect the reward money.

Presumably the hackers conducting the attacks will be staffed by the very same individuals that take part in the Bazooka Code course.

Unfortunately for Bazooka Code though, they appear to have attracted too much attention recently.

A few days ago they posted this long missive and announced that the entire program was moving to a new, lesser known and decentralized chat application, Matrix.

What Does all of this Mean?

AlphaLock appears to be at least relatively sophisticated and active across Telegram, Matrix, and the dark web forum XSS.

There are a few interesting insights we can gain into the broader cybercrime ecosystem from AlphaLock.

• Cybercrime sophistication and commoditization continues to grow: We now have a real life example of a threat group that seeks to create its own talent pool through a training program, goes to extensive lengths to market itself, and plans to monetize this through a hacker-for-hire scheme. The level of technical sophistication required to do this isn’t very high, but the level of organizational sophistication and business acumen is quite interesting.
• Ransomware isn’t the only game in town: Cybercriminals typically choose the path of least resistance that is most likely to prove profitable, this has been increasingly the case as the cybercrime ecosystem has evolved into a functional market economy. However AlphaLock represents another potential method to both monetize and democratize cybercrime. This could be a particularly interesting model alternative for ransomware groups if the U.S. follows through with the proposal of banning ransomware payments.
• A Technical Threat Actor Supply Shortage? One of the most fascinating things about AlphaLock is they want to create a pipeline of talent to populate their hacker marketplace. This suggests that there may be limitations on the supply of talented threat actors that have the required degree of sophistication to the point where they have tried to build their own pipeline of actors.
• The Brand: Our researchers have noted an increasing focus on group “brand” and identity among financially motivated threat groups. AlphaLock has clearly made significant investments in time to create a brand and reputation for itself. Notice in the final post they even advertise that they are looking to hire someone to market themselves on Telegram and social media.
• Blurred Lines: Many security practitioners have often assumed that threat actors primarily operate on the dark web. In most cases today this isn’t the case. There are increasingly blurred lines between clear web sites, Tor, and social media applications such as Telegram that create easy avenues for threat actors to congregate and communicate.

Monitor Illegal Telegram Groups & Other Sources with Flare

Flare delivers high-value, tailored continuous threat exposure management to organizations across industries.

Our SaaS platform detects threats across hundreds of dark web markets & forums, thousands of illicit Telegram channels, and clear web sources of risk.

Flare integrates into your existing security program in 30 minutes with native integrations that enable you to build a threat led cybersecurity program.

Sign up for a free trial to learn more.

Sponsored and written by Flare.

Original Source