Grief
Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files: .doppeled. It also creates a note file named: ".how2decrypt.txt".
Victims
3
First Discovered
victim2021-05-26
Last Discovered
victim2021-06-30
Avg Delay
between attack and claimN/A
Infostealer
for victim with domainN/A
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | FQDN | |
|---|---|---|---|---|---|---|
|
Grief list | No | 2025-06-01 21:18:37 | griefcameifmv4hfr3auozmovz5yi6m3h3dwbuqw7baomfxoxz4qteid.onion |
Target (Available)
Top 5 Activity Sectors
- Education Facilities 3
Top 5 Countries
-
United States
3
Heatmap (Available)
Ransom Notes (1)
Tools Used (Not Available)
No tools used available.
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (0)
No TTPs available.
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (1)
Indicators of Compromise (IoCs) (0)
No IoCs available for this group.
