Operator dossier

Doommageddon is a ransomware operator currently active on public leak sites. Darkfield has indexed 6 public victims claimed by this operator between July 6, 2026 and July 10, 2026. Doommageddon is a ransomware group first observed in July 2026 with an apparent primary motivation of financial gain, though limited public documentation exists given the group's recent emergence and relatively small operational footprint to date. Based on available data, the group has claimed or been attributed responsibility for approximately five known victims, with targeting concentrated in Turkey, Brazil, India, and Paraguay, suggesting a broad, opportunistic geographic scope rather than a regionally focused operational mandate. Targeted sectors include manufacturing, consumer services, financial services, and technology, a diverse vertical spread consistent with an opportunistic or nascent RaaS model still establishing its targeting criteria; no confirmed affiliation with established threat actor clusters or nation-state sponsors has been publicly documented by CISA, the FBI, Mandiant, or other reputable threat intelligence sources at this time. Specific initial access vectors, tooling, and encryption methodologies employed by Doommageddon have not been publicly detailed in available open-source or vendor reporting, and no confirmed double or triple extortion data leak site has been publicly attributed to the group by credible researchers. Given the group's first observation date of July 2026 and the very limited victim count, Doommageddon should be assessed as an emerging or low-maturity threat actor whose tactics, techniques, and procedures remain largely undocumented, and analysts should treat any further attribution or capability claims with appropriate caution pending additional corroborating intelligence. The group's current operational status cannot be definitively assessed beyond confirmation of initial activity in mid-2026.

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Doommageddon

6 victims indexed · first seen 9 days ago · last activity 5 days ago

Victims indexed

#238 of 364 tracked operators

<1m

Active period

Jul 2026 → Jul 2026

Countries hit

top TR · 2

At a glance

Status: active
First seen: 9 days ago
Last activity: 5 days ago
Onion sites: 1 known endpoint
Primary sector: Manufacturing · 2 hits

About

Doommageddon is a ransomware group first observed in July 2026 with an apparent primary motivation of financial gain, though limited public documentation exists given the group's recent emergence and relatively small operational footprint to date. Based on available data, the group has claimed or been attributed responsibility for approximately five known victims, with targeting concentrated in Turkey, Brazil, India, and Paraguay, suggesting a broad, opportunistic geographic scope rather than a regionally focused operational mandate. Targeted sectors include manufacturing, consumer services, financial services, and technology, a diverse vertical spread consistent with an opportunistic or nascent RaaS model still establishing its targeting criteria; no confirmed affiliation with established threat actor clusters or nation-state sponsors has been publicly documented by CISA, the FBI, Mandiant, or other reputable threat intelligence sources at this time. Specific initial access vectors, tooling, and encryption methodologies employed by Doommageddon have not been publicly detailed in available open-source or vendor reporting, and no confirmed double or triple extortion data leak site has been publicly attributed to the group by credible researchers. Given the group's first observation date of July 2026 and the very limited victim count, Doommageddon should be assessed as an emerging or low-maturity threat actor whose tactics, techniques, and procedures remain largely undocumented, and analysts should treat any further attribution or capability claims with appropriate caution pending additional corroborating intelligence. The group's current operational status cannot be definitively assessed beyond confirmation of initial activity in mid-2026.

References

1 link

External sources curated by the MISP threat-intel community.

ransomlook.io/group/doommageddon

Timeline

1 months

2026-07-01T00:00:00+00:002026-07-01T00:00:00+00:00

Top countries

🇹🇷 Türkiye

🇧🇷 Brazil

🇮🇳 India

🇵🇾 Paraguay

Türkiye dossier →Brazil dossier →India dossier →Paraguay dossier →

Top sectors

Manufacturing

Consumer Services

Financial Services

Technology

Manufacturing dossier →Consumer Services dossier →Financial Services dossier →Technology dossier →

MITRE ATT&CK

1 techniques · 1 tactics

Tactics

Impact

Techniques

T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known

http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion/

Source

Updated 5 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Doommageddon posts a victim.

Add Doommageddon to your watchlist — Pro pings you within 5 minutes of any new Doommageddon leak-site post, Telegram callout, or affiliate-rebrand inference.