Loading malware…
DoppelDridex is a modified Dridex variant associated with the cybercriminal group Doppel Spider, a subgroup or closely related offshoot of Evil Corp that emerged around 2019 alongside the DoppelPaymer ransomware operation. It has been used in banking-fraud campaigns and as part of broader financially motivated intrusion chains that can culminate in ransomware deployment. Reporting places DoppelDridex within the wider Dridex ecosystem, which evolved from the Bugat and GameOverZeuS lineage and is characterized by modular functionality, resilient botnet operations, and close overlap with other major eCrime services and malware families.
High-confidence reporting indicates Doppel Spider began operating DoppelDridex from April 2019. The malware has been observed as a second-stage payload delivered by other criminal distribution services, particularly Emotet, and has also been referenced in access-broker and botnet ecosystems that facilitated delivery of follow-on malware for multiple threat actors. DoppelDridex activity is linked to the same criminal milieu that used Dridex for credential theft, reconnaissance, and follow-on deployment of ransomware, especially BitPaymer and later DoppelPaymer.
As a Dridex-derived banking trojan, DoppelDridex is associated with credential theft and post-compromise activity in support of financial fraud and downstream intrusion objectives. Its operator, Doppel Spider, has been assessed as collaborating with or remaining operationally tied to Evil Corp rather than being wholly separate. Victimology and targeting are consistent with broad financially motivated campaigns rather than a single vertical, with use in both banking-fraud operations and enterprise compromises that support extortion-oriented attacks.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
depuis avril 2019,le groupe d’attaquants Doppel Spider opère une version modifiée de Dridex, Doppel-Dridex
5 distinct techniques documented for this family, organized by ATT&CK tactic.
several campaigns are leveraging attachments with the Excel 4.0 sheet-style macros to fetch the initial payload
leveraging attachments with the Excel 4.0 sheet-style macros to fetch the initial payload
To launch this malware, several campaigns are leveraging attachments with the Excel 4.0 sheet-style macros to fetch the initial payload
A modified version of the banking trojan Dridex – named DoppelDridex – is being delivered via payloads staged on Slack and Discord CDNs.
Deploying ransomware through which cyber actors remove victim access to data (usually via encryption), potentially causing significant disruption to operations.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.