AlumniLocker ransomware

AlumniLocker is a Windows ransomware built from the Thanos ransomware family, first seen in early 2021. It adds .alumni to encrypted files, so photo.jpg becomes photo.jpg.alumni, and opens a text note in Notepad. The note is saved as HOW_TO_RECOVER_YOUR_FILES.txt. It asks for 10 BTC within 48 hours to address 35LikWJCjvfHWDZezZXswgqNeuT6gv36YM and gives the Telegram account AlumniLocker and alumnilocker[@]protonmail.com for contact. The operators say they will not reply until payment proof is sent. AlumniLocker arrives as a PDF email attachment that leads to a ZIP holding a fake JPG. That file is a PowerShell script that fetches the Themida-packed .NET encryptor through BITS. The note claims the files were backed up to the attackers' servers and threatens to post them on a Tor Wall of Shame site, but no leaked data has been confirmed. AlumniLocker is a Thanos variant.

Sources: In-house research

File extensions: .alumni

Ransom note filenames: HOW_TO_RECOVER_YOUR_FILES.txt

Decryptor: No public decryptor was found. Checked 2026-10-13.

Data exfiltration risk: Likely — The note claims the files were copied to the attackers' servers and threatens to publish them on a Tor 'Wall of Shame' within 48 hours. No leaked victim data has been confirmed.

Systems typically targeted: Windows systems reached through a PDF email attachment that pulls a PowerShell downloader, which fetches the encryptor through BITS.

Do this first: The infection chain starts with a PDF in email and a fake JPG that is really a PowerShell script, so pull the same message from other mailboxes. The ransom demand of 10 BTC comes with a 48-hour leak threat; treat it as a possible data breach until proven otherwise. AlumniLocker is a Thanos build, so check samples against the Thanos-family tools before assuming files are lost.

From the ransom note HOW_TO_RECOVER_YOUR_FILES.txt:

Your files is safely locked and automatically backup on our servers to unlock your files and get your password send this exact amount in 48 hours: 10 BTC ATTENTION: You just have 48 hours at the end of this period if you not pay this fee all of your personal files and data will be published on our WALL OF SHAME as public on internet. YOU CAN CONTACT WITH US INSTANT OVER ON TELEGRAM: AlumniLocker […]