← Back to all threat actors

doppelpaymer

Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files: .doppeled. It also creates a note file named: ".how2decrypt.txt".

How we source and review actor profiles

Motivation

ransomware

Last seen

2021-04-10

Sectors

manufacturing, government-defense, technology, education, transportation, agriculture-and-food-production

Status

Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

2021-04-10Claimed

Victim claimOffice of the Attorney General listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2021-04-10Last observed

Indicator1 indicator cataloged

Types: onion.

2021-03-01Claimed

Victim claimAzusa police department listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2021-02-21Claimed

Victim claimManutan listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2021-02-16Claimed

Victim claimKia Motors America (KMA) listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2021-02-08Claimed

Victim claimCuyahoga Metropolitan Housing Authority listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-11-29Claimed

Victim claimFoxconn listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-11-28Claimed

Victim claimDelaware County listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-11-08Claimed

Victim claimCompal listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-11-01Claimed

Victim claimBanijay Group SAS listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-10-28Claimed

Victim claimChatham County Government listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-10-07Claimed

Victim claimHall County listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-08-30Claimed

Victim claimNewcastle University listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-08-19Claimed

Victim claim4 Canadian courier divisions of TFI International's Canpar Express listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-08-01Claimed

Victim claimBoyce Technologies (device manufacturer- transit communication systems and now ventilators b/c of COVID-19) listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-06-11Claimed

Victim claimKnoxville PD and City of Knoxville, TN (Knox County) listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-06-05Claimed

Victim claimCity of Florence, Alabama listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-06-03Claimed

Victim claimDigital Management Inc. (NASA Contractor) listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-06-01Claimed

Victim claimMitsubishi listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-04-17Claimed

Victim claimAfpa listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-03-05Claimed

Victim claimKimchuk listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-03-01Claimed

Victim claimCity of Torrance (Los Angeles County) listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-02-01Claimed

Victim claimVisser Precision listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2020-01-01Claimed

Victim claimBretagne Telecom listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2019-06-01Claimed

Victim claimChilean Ministry of Agriculture listed by doppelpaymer

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 26 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

doppelpaymerCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...