Loading malware…
DoppelPaymer is an enterprise-targeting Windows ransomware family that emerged in 2019 as a fork of BitPaymer. Operated under a ransomware-as-a-service model, it has been used against companies, public institutions, and critical infrastructure across multiple countries. Documented victims include Mexico’s state-owned oil company Pemex, manufacturer Visser Precision, and University Hospital Düsseldorf.
DoppelPaymer encrypts files using AES-256 with RSA-2048 protection for encryption key material. Its operators employ double extortion: stealing confidential information before encryption and threatening public disclosure if victims refuse to pay. The operation launched a public leak site in early 2020 to publish stolen files and pressure non-paying organizations. Attacks can involve broad deployment across hundreds or thousands of networked devices, and operators have also targeted backup infrastructure to undermine recovery.
Distribution has included phishing and spam emails with malicious JavaScript or VBScript attachments, and Emotet infections have facilitated DoppelPaymer attacks. Intrusions use legitimate and dual-use tools, including Mimikatz for credential theft, PsExec for remote execution and lateral movement, and Cobalt Strike for post-exploitation activity. DoppelPaymer embeds Process Hacker components used to terminate processes, including security-related processes, and uses encrypted strings and packing to conceal its behavior.
The operation transitioned to the Grief branding in 2021. Grief retained substantial DoppelPaymer code, encryption algorithms, and ransom-portal functionality, with relatively limited implementation changes.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
8 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
These suspicions grow stronger with today’s report from Sophos, which notes that the same packer code was detected on Sophos-protected systems targeted with DoppelPaymer ransomware.
CYFIRMA Researchers suspect this threat actor to be responsible for operating DoppelPaymer and DoppelDridex.
Cybersecurity researchers, including TRU, believe the Grief Group is merely a rebrand of the DoppelPaymer Ransomware Group.
Cybersecurity researchers, including TRU, believe the Grief Group is merely a rebrand of the DoppelPaymer Ransomware Group.
The most active ransomware gang targeting Japanese entities appears to be the DoppelPaymer gang. The DoppelPaymer ransomware emerged in 2019 and is believed to have links with former members of the TA505 hacking group.
Doppel Spider opérerait lui une version modifiée de Dridex, DoppelDridex, ainsi qu’une variante du rançongiciel BitPaymer, DoppelPaymer.
+2 more in the app. View in Mallory
28 distinct techniques documented for this family, organized by ATT&CK tactic.
DoppelPaymer is an enterprise-targeting ransomware that compromises a corporate network, eventually gains access to admin credentials, and then deploys the ransomware on the network to encrypt all devices.
Erst jetzt, viele Monate später, haben sie diese Backdoor benutzt, um wieder Zugriff auf das Netz der Uni-Klinik zu erlangen.
Das wahrscheinlichste Szenario ist somit derzeit, dass die Cyberkriminellen die Shitrix-Lücke sehr bald nach ihrem Bekanntwerden und noch vor der Bereitstellung des Patches durch Citrix ausgenutzt haben. Sie sind dann darüber in das Netz der Uni-Klinik eingedrungen
Initial Compromise ... § Phishing
DoppelPaymer uses a fairly sophisticated routine, starting off with network infiltration via malicious spam emails containing spear-phishing links or attachments designed to lure unsuspecting users into executing malicious code that is usually disguised as a genuine document.
DoppelPaymer uses a fairly sophisticated routine, starting off with network infiltration via malicious spam emails containing spear-phishing links or attachments designed to lure unsuspecting users into executing malicious code that is usually disguised as a genuine document.
This would have eventually provided network access to the DoppelPayer actors who would then have used Cobalt Strike and PowerShell Empire to spread the ransomware laterally through the rest of the network.
In early 2020, the following delivery mechanisms were seen – Group Policies ... – PsExec – BITS Jobs – Scheduled Tasks
DoppelPaymer is an enterprise-targeting ransomware that compromises a corporate network, eventually gains access to admin credentials, and then deploys the ransomware on the network to encrypt all devices.
Erst jetzt, viele Monate später, haben sie diese Backdoor benutzt, um wieder Zugriff auf das Netz der Uni-Klinik zu erlangen.
In early 2020, the following delivery mechanisms were seen – Group Policies ... – PsExec – BITS Jobs – Scheduled Tasks
The ransomware copies a legitimate service and replaces the original with a copy of itself
Sie sind dann darüber in das Netz der Uni-Klinik eingedrungen und haben dort heimlich eine Backdoor platziert.
The Boot Configuration database is altered – recoveryenabled: no – Startup repair is disabled – safeboot: minimal
DoppelPaymer is an enterprise-targeting ransomware that compromises a corporate network, eventually gains access to admin credentials, and then deploys the ransomware on the network to encrypt all devices.
The ransomware copies a legitimate service and replaces the original with a copy of itself
Sie sind dann darüber in das Netz der Uni-Klinik eingedrungen und haben dort heimlich eine Backdoor platziert.
The Boot Configuration database is altered – recoveryenabled: no – Startup repair is disabled – safeboot: minimal
such as the love of hiding RC4 encrypted strings using a 40 byte key that is reversed which is also used by Dridex and DoppelPaymer
DoppelPaymer is an enterprise-targeting ransomware that compromises a corporate network, eventually gains access to admin credentials, and then deploys the ransomware on the network to encrypt all devices.
In early 2020, the following delivery mechanisms were seen – Group Policies ... – PsExec – BITS Jobs – Scheduled Tasks
§ Disable antivirus across entire estate
Finally, DoppelPaymer will change user passwords before forcing a system restart into safe mode to prevent user entry from the system.
Cybercriminals employ the features of Mimikatz for credential dumping to extract usernames, passwords, and other credentials that might be used to escalate privilege in other phases of the attack.
Identify domains and networks of interest
With attackers leveraging the features that enable a user to execute processes on remote systems, PsExec can be abused for arbitrary command shell execution and lateral movement.
§ RDP
PsExec can also be used for propagation and remote execution of ransomware.
This would have eventually provided network access to the DoppelPayer actors who would then have used Cobalt Strike and PowerShell Empire to spread the ransomware laterally through the rest of the network.
For years, it is has been a well-known secret that ransomware attackers are looking through and stealing victim's files before encrypting computers and then threatening to release them.
Qbot and TrickBot, in particular, were Emotet’s main customers and used their access to deploy ransomware (e.g. Ryuk, Conti, ProLock, Egregor, DoppelPaymer, and others).
“gegevens stelen” en in het voorbeeld: “10GB data naar server in Finland.”
before encrypting devices on the network the attackers will first delete the backups so that they cannot be used to restore encrypted files.
“bestanden versleutelen” en “Single extortion: bestanden of systemen van het slachtoffer zijn versleuteld.”
DoppelPaymer has a crc32 list of processes and services it will terminate. If a process or service in its list is running, it will trigger the Process Hacker to terminate it.
The Boot Configuration database is altered – recoveryenabled: no
The Grief gang also uses the exposed documents as a way of pressuring the victims to pay. It serves as a warning, that should the victims decide not to pay, Grief will expose more sensitive information.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
88 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.