DOPPEL SPIDER

Doppel Spider is a financially motivated cybercriminal threat actor associated with the Evil Corp ecosystem and widely linked to targeted ransomware operations. The group emerged publicly around April 2019 as a subgroup or split from Evil Corp, alongside Indrik Spider, but reporting also indicates continued collaboration with Evil Corp rather than a fully separate organization. Doppel Spider is known for operating modified Dridex malware referred to as DoppelDridex and a BitPaymer-derived ransomware variant known as DoppelPaymer. The actor has also been associated with use of Emotet as a delivery service for its malware. Operationally, Doppel Spider fits the mature eCrime model in which initial malware access is leveraged for hands-on-keyboard intrusion and ransomware deployment against enterprise victims. Its activity includes use of Dridex-family tooling for initial access and post-compromise reconnaissance, followed by deployment of ransomware for monetization. The group has been reported to exfiltrate large volumes of victim data and to operate a leak site with escalating ransom pressure, indicating data-theft extortion in addition to encryption-based ransomware. Public reporting also places Doppel Spider among actors that publicly claimed they would avoid or remediate infections affecting healthcare providers, reflecting awareness of victim-sector sensitivity during 2020. Known tooling and malware associated with Doppel Spider include DoppelDridex, DoppelPaymer, BitPaymer lineage malware, and use of Emotet-delivered infection chains. The actor is part of the broader Russian-speaking cybercriminal milieu tied to Dridex and Evil Corp operations. High-confidence reporting supports characterization of Doppel Spider as an Evil Corp-linked ransomware subgroup specializing in enterprise intrusion, data exfiltration, and extortion.