DoppelPaymer

DoppelPaymer is a ransomware family and ransomware operation associated in the provided content with Evil Corp lineage and described as an offshoot or evolution connected to BitPaymer. The content states that it shares code and similar tactics with BitPaymer, and that Grief was later described as an offshoot of the DoppelPaymer group. DoppelPaymer is repeatedly described as using double-extortion tactics: operators steal data before encrypting systems and then publish or threaten to publish stolen files on a leak site to increase pressure on victims. Reported activity includes publication of stolen files from victims such as Visser Precision and Foxconn, and claims of selling previously stolen data on the dark web.

The malware has been deployed in enterprise intrusions affecting large organizations, including manufacturing and industrial targets. High-confidence victim examples in the content include Foxconn’s CTBG MX facility in Ciudad Juárez, Mexico, where operators reportedly demanded 1804.0955 BTC (about $34.7 million), claimed to have stolen 100 GB of data, encrypted roughly 1,200 to 1,400 servers, and destroyed 20 to 30 TB of backup data. Other victims explicitly named in the content include Visser Precision, Bretagne Télécom, Compal, the City of Torrance, Hall County in Georgia, Newcastle University, PEMEX, and Banijay Group SAS. CERT-FR reporting cited in the content says the Lockean affiliate first deployed DoppelPaymer in 2020 against a French manufacturing company.

The content links DoppelPaymer distribution and affiliate activity to several initial access ecosystems. SocGholish/FakeUpdates/GhoLoader has been used to deploy DoppelPaymer. TA551, also tracked as Shathak, UNC2420, Gold Cabin, Monster Libra, ATK236, and G0127, is described as a collaborator that helped deliver DoppelPaymer payloads, including via Qbot/QakBot-infected devices. Lockean intrusions were said to commonly begin with Qbot/QakBot delivered via Emotet or TA551, and in at least one case via IcedID, before ransomware deployment. The content also notes code-similarity observations between Emotet dynamic API resolution behavior and Dridex or BitPaymer/DoppelPaymer code.

Behaviorally, the content directly attributes to DoppelPaymer the use of data theft prior to encryption, leak-site extortion, and destructive impact on backups in at least one incident. Mandiant research cited in the content also found process kill lists deployed alongside DoppelPaymer, indicating use of pre-encryption process termination tradecraft to amplify ransomware impact, including in operational technology contexts. Additional defensive-evasion behavior referenced in the content includes abuse of legitimate rootkit removal kits such as GMER to impair or disable defensive tools, though this is presented as behavior observed in relation to DoppelPaymer-linked reporting rather than as a full malware specification.

Associated actors and relationships mentioned in the content include Evil Corp, Indrik Spider, Lockean, TA551, and broader financially motivated intrusion ecosystems involving Qbot/QakBot, Emotet, IcedID, and SocGholish. The content also notes sanctions-related concern around groups descended from or linked to Evil Corp. No standalone IOC set for DoppelPaymer itself is provided in the content, but incident-specific indicators include the Foxconn ransom demand of 1804.0955 BTC, claimed theft of 100 GB of data, encryption of 1,200 to 1,400 servers, destruction of 20 to 30 TB of backups, and use of a Tor-based payment or leak site.