Loading malware…
DoppelPaymer is a human-operated ransomware family associated with financially motivated intrusion activity and widely known for enterprise-targeted extortion. It has been linked to intrusion chains in which access is first established through other malware ecosystems, particularly Dridex-compromised environments, after which operators conduct hands-on-keyboard activity and deploy ransomware across victim networks. The malware became notable during the broader shift toward big-game hunting and double extortion, in which attackers both encrypt systems and steal data to pressure victims with public leaks.
DoppelPaymer operators have used dedicated leak sites to publish samples of stolen corporate data and escalate pressure when victims refuse to pay. This behavior places the family among the early ransomware operations that normalized public naming-and-shaming and data-leak extortion as part of ransomware negotiations. Reported victimology includes enterprises, managed IT service providers, and organizations with downstream exposure to government and large commercial customers, illustrating the risk of supply-chain and third-party compromise.
Operationally, DoppelPaymer is associated with post-compromise ransomware deployment rather than indiscriminate self-propagation. Campaign reporting places it in the same ecosystem as other manually deployed ransomware families used after initial footholds are obtained through commodity crimeware. Its observed tradecraft includes encryption of large numbers of systems within enterprise environments and exfiltration of internal documents for extortion leverage. DoppelPaymer is part of the broader financially motivated ransomware landscape that evolved from pure file encryption into combined disruption, theft, and public extortion.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as ransomware associated with Dridex in an example of botnet-to-ransomware partnerships. No further details provided.
Ransomware family listed among gangs actively leaking stolen files on blogs.
Ransomware used to breach DMI, encrypt servers and workstations, and extort victims by publishing stolen data on a leak site if payment is refused.
Referenced as another ransomware example associated with prior malware infections.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.