Doppelpaymer

DoppelPaymer is a sophisticated ransomware operation that emerged in May 2019, operating as a financially motivated cybercriminal enterprise focused on high-value targets across multiple sectors. The group is believed to have connections to Russia and operates independently rather than as a traditional Ransomware-as-a-Service model, though they have been linked to the earlier Dridex banking trojan operations and may share infrastructure or personnel with the Evil Corp cybercriminal organization. DoppelPaymer operators primarily gain initial access through phishing campaigns, exploitation of Remote Desktop Protocol vulnerabilities, and leveraging existing Dridex infections, utilizing tools such as Cobalt Strike, PowerShell Empire, and various living-off-the-land techniques before deploying their custom ransomware that employs RSA-2048 and AES-256 encryption algorithms. The group pioneered double extortion tactics by operating a leak site called "Dopple Leaks" where they publish stolen data from victims who refuse to pay ransoms, systematically exfiltrating sensitive information before encryption deployment. Notable campaigns include attacks on major healthcare systems during the COVID-19 pandemic, critical infrastructure targets, and educational institutions, with the group demanding ransoms typically ranging from hundreds of thousands to several million dollars, leading to FBI alerts and international law enforcement attention. As of recent observations, DoppelPaymer activity has significantly decreased since late 2021, with many researchers believing the group has either ceased operations or rebranded under a different identity following increased law enforcement pressure.