Ransomware Group: ALPHALOCKER

VICTIM NAME: www[.]sonoshowmoveis[.]com[.]br

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the ALPHALOCKER Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The leak post is dated September 29, 2025, at 11:19:40.174576, concerning the victim domain www[.]sonoshowmoveis[.]com[.]br[.] The metadata identifies the attack as a data-leak event claimed by the alphalocker group. The post states that 23 GB of data were exfiltrated, including clients, projects, financial documentation, and related materials. No explicit compromise date is provided; therefore, the post date is treated as the reporting timestamp. A claim URL is indicated on the leak page, though no direct URLs are included in this summary. The domain suggests the victim is based in Brazil, although the industry is not specified in the provided data.

The page describes a data-leak scenario rather than encryption. There are no screenshots or images recorded (images_count is 0), and metadata shows no downloadable files or attachments beyond the stated data. No ransom amount is listed in the available metadata. In summary, 23 GB of data—comprising clients, project records, and financial documents—are claimed to have been exfiltrated, with the incident attributed to the alphalocker actor and the victim name www[.]sonoshowmoveis[.]com[.]br preserved for reporting purposes.