Doppelpaymer
Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files: .doppeled. It also creates a note file named: ".how2decrypt.txt".
External information
Victims
24
First Discovered
victim2019-05-25
Last Discovered
victim2021-04-10
Avg Delay
between attack and claimN/A
Infostealer
for victim with domain100.0%
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | FQDN | |
|---|---|---|---|---|---|---|
|
Start-maximized.com | No | 2025-06-01 21:18:50 | hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qnwad.onion |
Target (Available)
Top 5 Activity Sectors
- Government Facilities 10
- Critical Manufacturing 8
- Communication 2
- Food and Agriculture 1
- Information Technology 1
Top 5 Countries
-
United States
15
-
France
3
-
Chile
1
-
Canada
1
-
Mexico
1
Heatmap (Available)
Ransom Notes (4)
Tools Used (Not Available)
No tools used available.
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (0)
No TTPs available.
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (0)
No YARA rules available.
Indicators of Compromise (IoCs) (0)
No IoCs available for this group.
Victims (24)
4 Canadian courier divisions of TFI International's Canpar Express
Doppelpaymer
Discovery Date: 2020-08-19
N/A
Boyce Technologies (device manufacturer- transit communication systems and now ventilators b/c of COVID-19)
Doppelpaymer
Discovery Date: 2020-08-01
N/A
