Loading story…
The Grief ransomware operation emerged as a rebrand of DoppelPaymer, continuing the group’s double-extortion model of stealing data before encrypting systems and threatening publication on leak sites if victims refuse to pay. Earlier DoppelPaymer activity had already shown this approach through its public "Dopple Leaks" site, where operators exposed allegedly stolen victim data to increase pressure, reinforcing that these incidents should be treated as both ransomware attacks and data breaches.
Intrusions tied to Grief commonly chained Dridex infections with Cobalt Strike post-exploitation activity before ransomware deployment. Researchers observed attackers abusing DLL search order hijacking, masquerading, process injection, and signed binary proxy execution, including relocating legitimate Windows binaries to load malicious DLLs and using rundll32.exe to launch payloads that altered services, boot settings, registry keys, and Microsoft Defender protections. In some cases, the malware used bcdedit.exe to disable recovery and force safe mode boot, while changing service ImagePath values for persistence; analysts also noted that shadow copies were not always deleted, leaving a possible recovery path for some victims.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Red Canary said Grief was first observed in May 2021 as a double-extortion ransomware operation. The report also noted external observations that Grief may be a rebrand of DoppelPaymer.
A South African logistics and supply chain company listed on DoppelPaymer's leak site was said to have been encrypted on January 20, 2020, with a ransom demand of 50 bitcoins.
BleepingComputer reported that Pemex was attacked by DoppelPaymer on November 10, 2019, and the attackers demanded 568 bitcoins for a decryptor.
Red Canary published technical analysis linking observed Grief intrusions with prior Dridex infections and Cobalt Strike activity, and described the ransomware's use of DLL hijacking, process injection, service modification, boot changes, Defender tampering, and ransom-note registry changes.
The operators of DoppelPaymer launched a public leak site called 'Dopple Leaks' to shame non-paying victims and publish files stolen before encryption. The site was described by the operators as being in 'test mode' and initially listed four alleged victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourceredcanary.com
Open sourcebleepingcomputer.com
Open sourcesecureworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators behind **REvil/Sodinokibi** and **DoppelPaymer** increasingly ran intrusions like targeted espionage campaigns, combining long dwell times, privilege escalation, lateral movement, data theft, and enterprise-wide encryption. Research from Mandiant, Secureworks, JPCERT/JSAC, and CERT-FR describes attackers gaining entry through exposed **RDP** and **VPN** services, phishing-delivered malware such as **QAKBOT**, **Emotet**, and **Dridex**, brute force, and exploitation of internet-facing systems, then expanding control with tools including **Mimikatz**, **BloodHound**, **PsExec**, **WMI**, **Cobalt Strike**, and **Empire**. In many cases, affiliates or partner crews obtained domain administrator access, tampered with backups and security tools, abused Active Directory group policy and scheduled tasks, and used open SMB shares or administrative utilities to push ransomware across networks. REvil also helped normalize **double extortion** by stealing data before encryption, threatening public leaks, and in some cases publishing victim files or warning that stolen information could be sold or used to pressure public companies through market disclosure. Reporting on Sodinokibi showed the gang first releasing allegedly stolen victim data after nonpayment and later promoting leak-site tactics as a standard coercion method, while Sophos observed exfiltration in roughly half of investigated REvil incidents, often staging data in **Mega.nz**. Separate reporting said REvil’s operators secretly retained a master decryption capability and allegedly hijacked affiliate negotiations, underscoring how ransomware-as-a-service groups maintained centralized control even as affiliates conducted the intrusions.
Aug 15, 2026
Sophos reported that two organizations hit by **Entropy ransomware** were first compromised through intrusions involving **Dridex** and remote-access tooling such as **Cobalt Strike**. One attack targeted a North American media company through **ProxyShell** exploitation and unfolded over roughly four months, while another began with a malicious email attachment sent to a regional government organization and escalated to data exfiltration in about 75 hours. In both cases, the attackers relied on widely available administrative and commercial tools for lateral movement, staging, and theft, including **PsExec**, **PsKill**, **AdFind**, **WinRAR**, **ScreenConnect**, and cloud storage services. Reverse-engineering of the malware found notable similarities between Entropy and Dridex, including shared packer behavior, vectored exception handler setup, string decryption, and API resolution logic. Sophos said the overlap may indicate a development relationship and also noted packer detections previously tied to **DoppelPaymer**, adding to evidence that Entropy could belong to the ransomware lineage associated with **Evil Corp**. The findings underscore how unpatched internet-facing systems and weak authentication can enable long-running intrusions that end in ransomware deployment and data theft.
Aug 14, 2026
The **Egregor** ransomware operation carried out double-extortion attacks by stealing sensitive data, encrypting victim systems, and threatening to publish stolen information on a leak site if victims refused to pay. Researchers linked Egregor to an ecosystem associated with **Sekhmet** and possible former **Maze** affiliates, with additional reported ties to **ProLock** and **LockBit**. Victims cited in reporting included **GEFCO**, **Barnes & Noble**, and **Ubisoft**, while the group’s leak site reportedly listed **152 victim companies** across industries including information technology, construction, retail, consumer goods, and automotive. Intrusions commonly began with **phishing** or **RDP exploitation**, after which attackers used **Cobalt Strike** for payload delivery and in some cases leveraged **QBot** and living-off-the-land tools such as `bitsadmin`. The malware used heavily obfuscated DLL payloads with **Salsa20**-encrypted configuration data, required a sample-specific launch key passed with the `-p` parameter, and encrypted files with **ChaCha** and **RSA-2048**. Researchers also observed the group using **Rclone** with attacker-supplied configuration data to exfiltrate stolen files, while the ransomware appeared to avoid encrypting systems configured with several CIS-region languages.
Jul 12, 2026