Loading threat actor…
DoubleFace, also referred to as Doubleface Team, Double Alliance, and in some reporting as Invisible or Doubleface ransomware, is a hacktivist-linked ransomware actor that emerged in August-September 2024. The group is associated with a fluid ecosystem of pro-Russia-aligned actors and appears to have formed through a convergence of associates connected to CyberVolk and the Moroccan Black Cyber Army. DoubleFace has also been promoted by CyberVolk and linked to collaborative relationships with other ransomware operators, including an announced alliance with HexaLocker for larger attacks. DoubleFace is notable for operating ransomware closely related to the CyberVolk and AzzaSec code lineage. Its ransomware has been assessed as functioning nearly identically to CyberVolk ransomware and as derived from leaked AzzaSec ransomware source code. Reported implementations use AES-256 for file encryption with RSA-2048 key wrapping, deploy a ransom note, and maintain a built-in decryption countdown timer. The actor therefore demonstrates ransomware tradecraft centered on encryption-based extortion rather than novel malware engineering. Beyond ransomware, DoubleFace has been observed in the broader hacktivist threat landscape targeting Ukraine, where it has been counted among smaller but active groups contributing to disruptive operations. In that context, the actor has been associated with campaigns affecting government and other critical sectors. The surrounding ecosystem emphasizes politically framed attacks, opportunistic alliances, and reuse of commodity or leaked tooling rather than stable long-term organizational structure. DoubleFace should be understood as part of a fragmented, rapidly shifting cluster of hacktivist and ransomware actors whose branding, partnerships, and tooling overlap substantially. High-confidence aliases include Doubleface Team, Double Alliance, and Invisible/Doubleface ransomware.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Affiliate group tied to CyberVolk that promoted and used ransomware derived from the AzzaSec codebase, with leaked builder/source and similar operational behavior to CyberVolk ransomware.
Doubleface is a smaller hacktivist group involved in cyberattacks against Ukraine.
A ransomware gang mentioned as entering into an alliance with HexaLocker to collaborate on larger attacks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.