alphaghoul
AlphaGhoul is a cybercriminal threat actor active on underground forums, primarily known for promoting and selling the NtKiller tool. NtKiller is designed to silently disable antivirus and endpoint detection solutions, including Microsoft Defender, ESET, Kaspersky, Bitdefender, and Trend Micro, and claims to bypass enterprise-grade EDRs. The tool employs early-boot persistence, anti-debugging, and anti-analysis protections, and offers advanced features such as rootkit capability and silent UAC bypass for privilege escalation, available as modular add-ons. NtKiller is marketed for commercial sale to other cybercriminals, with a pricing structure reflecting its technical sophistication. The effectiveness of NtKiller has not been independently verified. There is no evidence linking AlphaGhoul to any nation-state or APT activity; the actor appears to be financially motivated and focused on enabling other cybercriminals through tool development and distribution.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
AlphaGhoul is a cybercriminal selling NtKiller, a tool designed to terminate security solutions and evade detection, with additional rootkit and UAC bypass capabilities.
AlphaGhoul is promoting and likely developing or distributing NtKiller, a tool designed to disable antivirus and endpoint detection solutions, enabling attackers to evade detection and maintain persistence on compromised systems.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.