DoppelPaymer
Aliases: Pay OR Grief
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 12:40:59
Targeted industries: healthcare-and-pharmaceutical government-and-public-sector financial-services manufacturing education-and-nonprofits
Targeted regions: country_code:us country_code:de country_code:gb
Context
Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files: .doppeled. It also creates a note file named: ".how2decrypt.txt".
Detection coverage
- 2 YARA rules
Detection rules
- CAPE_Doppelpaymer (yara-rule)
- MALPEDIA_Win_Doppelpaymer_Auto (yara-rule)
Reports & references
- CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
- CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
- secureworks.com — Gold Heron (report)
- CrowdStrike — Report2021Gtr (report)
- Microsoft — Human Operated Ransomware Attacks A Preventable Disaster (report)
- CrowdStrike — How Big Game Hunting Ttps Shifted After Darkside Pipeline Attack (report)
- cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
- docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
- i.blackhat.com — Eu 20 Clarke Its Not Finished The Evolving Maturity In Ransomware Operations Wp (report)
- i.blackhat.com — Eu 20 Clarke Its Not Finished The Evolving Maturity In Ransomware Operations (report)
- ke-la.com — How Ransomware Gangs Find New Monetization Schemes And Evolve In Marketing (report)
- ke-la.com — To Attack Or Not To Attack Targeting The Healthcare Sector In The Underground Ecosystem (report)
- ke-la.com — Zooming Into Darknet Threats Targeting Jp Orgs Kela (report)
- krebsonsecurity.com — Ransomware Gangs And The Name Game Distraction (report)
- public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)
- sites.temple.edu — Ci Rw Attacks (report)
- Broadcom/Symantec — The Ransomware Threat September 2021 (report)
- vulnerability.ch — Ransomware And Date Leak Site Publication Time Analysis (report)
- web.archive.org — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
- bleepingcomputer.com — Three More Ransomware Families Create Sites To Leak Stolen Data (report)
- cert.ssi.gouv.fr — Certfr 2021 Cti 009 (report)
- cert.ssi.gouv.fr — Certfr 2021 Cti 009 (report)
- hornetsecurity.com — Leakware Ransomware Hybrid Attacks (report)
- paloaltonetworks.com — Unit42 Ransomware Threat Report 2021 (report)
- pwc.co.uk — What Is Behind Ransomware Attacks Increase (report)