Doppelpaymer

DoppelPaymer is a type of malware, specifically ransomware, that was initially developed and operated by the GOLD DRAKE threat group under the name BitPaymer. The software was later reworked and renamed to DoppelPaymer by another threat group, GOLD HERON. This malicious software first appeared in mid-2019 and began being used for double extortion attacks in early 2020. It has primarily targeted large organizations, demanding ransoms exceeding $1 million. Notable victims include computer manufacturer ASUS, municipalities like Augusta, George, and energy giant ConocoPhillips. In 2021, the ransomware underwent another rebranding and started operating under the name Grief. Law enforcement agencies from Germany and Ukraine conducted operations targeting key members of the DoppelPaymer ransomware group in February 2023. Two individuals, including a German national and Turashev, who had been wanted by German law enforcement since 2023 for his alleged involvement in running the ransomware, were arrested. These arrests marked significant progress in the ongoing fight against cybercrime and ransomware threats. The arrest of the DoppelPaymer operators aligns with a broader trend of increased law enforcement activity against ransomware gangs. Earlier in the same year, agencies successfully disrupted the HIVE and Genesis ransomware operations. Additionally, the suspected developer of the Ragnar Locker ransomware gang was apprehended in Paris. Despite these successes, DoppelPaymer remains an active threat, underscoring the importance of continued vigilance and cybersecurity measures among potential target organizations.