Loading story…
DoppelPaymer ransomware operators used phishing emails, malicious attachments, and links to gain initial access, often chaining infections through Emotet and Dridex before deploying the final payload. After compromise, the attackers used tools including PowerShell Empire, Cobalt Strike, PsExec, and Mimikatz to steal credentials, move laterally, disable security controls, and prepare systems for encryption. The malware encrypted files on network, fixed, and removable drives, changed user passwords, rebooted systems into safe mode, and displayed a ransom note warning that stolen sensitive data could be leaked publicly.
The campaign disproportionately affected healthcare, emergency services, and education organizations, with reported incidents including a German hospital, a county E911 center, community colleges, and police and emergency services in a U.S. city. The activity highlighted a double-extortion model in which operational disruption was paired with data-theft pressure, while defenders were urged to harden email security, maintain offline backups, patch exposed systems, audit privileged accounts, monitor network traffic, enable 2FA, and enforce least-privilege access.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
The content says DoppelPaymer targeted another community college in September 2020. This is listed among the campaign's notable attacks on education-sector organizations.
The content states that DoppelPaymer also targeted a county E911 center in September 2020. This incident is presented as part of the ransomware's focus on emergency services organizations.
In September 2020, DoppelPaymer targeted a German hospital, disrupting communications and general operations. The incident is cited as a notable example of the group's impact on healthcare organizations.
The content says DoppelPaymer affected police and emergency services in a U.S. city in mid-2020. The incident is described as one of several attacks against critical public-sector targets.
The content states that DoppelPaymer was involved in attacks in 2020 and that one incident disrupted a community college. No more specific date is provided for this event.
In July 2019, DoppelPaymer actors infected 13 of 380 servers at a U.S. medical center and demanded 50 Bitcoin, worth about $600,000 at the time. The medical center needed several weeks to restore systems from offsite backups.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used the low-cost **Philadelphia** ransomware to run targeted campaigns against healthcare institutions and other organizations in the same city, delivering malware through spoofed internal-looking emails themed around patients and linked via `bit.do` URLs. The operation stood out because ransom notes were customized with victim organization names, demanded **15 Bitcoin**, and threatened to delete files on a timed schedule, showing a level of personalization more often associated with higher-end ransomware operations. Proofpoint reported that Philadelphia supported multiple delivery paths, including zipped executables linked from emails, macro-enabled Word documents that launched PowerShell, bundled installers on keygen and cracking sites, and distribution through the **Sundown** and **RIG** exploit kits. Its server-side configuration let operators set ransom amounts, Bitcoin addresses, victim IDs, and payment confirmation requirements, underscoring how commodity ransomware had evolved into a flexible platform for more tailored and aggressive attacks.
Aug 14, 2026
Ransomware operators behind **REvil/Sodinokibi** and **DoppelPaymer** increasingly ran intrusions like targeted espionage campaigns, combining long dwell times, privilege escalation, lateral movement, data theft, and enterprise-wide encryption. Research from Mandiant, Secureworks, JPCERT/JSAC, and CERT-FR describes attackers gaining entry through exposed **RDP** and **VPN** services, phishing-delivered malware such as **QAKBOT**, **Emotet**, and **Dridex**, brute force, and exploitation of internet-facing systems, then expanding control with tools including **Mimikatz**, **BloodHound**, **PsExec**, **WMI**, **Cobalt Strike**, and **Empire**. In many cases, affiliates or partner crews obtained domain administrator access, tampered with backups and security tools, abused Active Directory group policy and scheduled tasks, and used open SMB shares or administrative utilities to push ransomware across networks. REvil also helped normalize **double extortion** by stealing data before encryption, threatening public leaks, and in some cases publishing victim files or warning that stolen information could be sold or used to pressure public companies through market disclosure. Reporting on Sodinokibi showed the gang first releasing allegedly stolen victim data after nonpayment and later promoting leak-site tactics as a standard coercion method, while Sophos observed exfiltration in roughly half of investigated REvil incidents, often staging data in **Mega.nz**. Separate reporting said REvil’s operators secretly retained a master decryption capability and allegedly hijacked affiliate negotiations, underscoring how ransomware-as-a-service groups maintained centralized control even as affiliates conducted the intrusions.
Aug 15, 2026
Sophos reported that two organizations hit by **Entropy ransomware** were first compromised through intrusions involving **Dridex** and remote-access tooling such as **Cobalt Strike**. One attack targeted a North American media company through **ProxyShell** exploitation and unfolded over roughly four months, while another began with a malicious email attachment sent to a regional government organization and escalated to data exfiltration in about 75 hours. In both cases, the attackers relied on widely available administrative and commercial tools for lateral movement, staging, and theft, including **PsExec**, **PsKill**, **AdFind**, **WinRAR**, **ScreenConnect**, and cloud storage services. Reverse-engineering of the malware found notable similarities between Entropy and Dridex, including shared packer behavior, vectored exception handler setup, string decryption, and API resolution logic. Sophos said the overlap may indicate a development relationship and also noted packer detections previously tied to **DoppelPaymer**, adding to evidence that Entropy could belong to the ransomware lineage associated with **Evil Corp**. The findings underscore how unpatched internet-facing systems and weak authentication can enable long-running intrusions that end in ransomware deployment and data theft.
Aug 14, 2026