DOPPEL SPIDER

Also known as: BitPaymer, Blue Lelantos, DOPPEL SPIDER, Doppel spider, DoppelPaymer, DoppelPaymer gang, DoppelPaymer group, DoppelPaymer ransomware, FriedEx, GOLD HERON, Gold Heron, Grief Group, IEncrypt, Pay OR Grief, doppel paymer

In June 2019, CrowdStrike Intelligence observed a source code fork of BitPaymer and began tracking the new ransomware strain as DoppelPaymer. Further technical analysis revealed an increasing divergence between two versions of Dridex, with the new version dubbed DoppelDridex. Based on this evidence, CrowdStrike Intelligence assessed with high confidence that a new group split off from INDRIK SPIDER to form the adversary DOPPEL SPIDER. Following DOPPEL SPIDER’s inception, CrowdStrike Intelligence observed multiple BGH incidents attributed to the group, with the largest known ransomware demand being 250 BTC. Other demands were not nearly as high, suggesting that the group conducts network reconnaissance to determine the value of the victim organization.

🌍 Country Russia

Associated Operations

$20 million ransom $34 million ransom & Service Companies in U.K. & Europe 2020-02 2020-03 2020-06 2020-08 2020-09 2020-10 2020-11 2020-12 2021-02 2021-04 2021-07 2021-09 2021-10 Big Brother producer hit by DoppelPaymer ransomware Breach of the Illinois Attorney General’s Office Compal Death occurred after a patient was diverted to a nearby hospital after the Duesseldorf University Hospital suffered a ransomware attack. DoppelPaymer ransomware gang rebrands as the Grief group DopplePaymer ransomware gang claims to have breached DMI Foxconn electronics giant hit by ransomware Grief Gang’s New Quadruple Extortion Scheme Doesn’t Change the Game Grief Ransomware Gang Claims 41 New Victims Hall County in Georgia announced that they had suffered a ransomware attack that impacted their networks and phone systems. Kia Motors America suffers ransomware attack Lockheed Martin MasterChef Municipalities NRA: No comment on Russian ransomware gang attack claims On October 7th Ransomware gang threatens to wipe decryption key if negotiator hired Ransomware scumbags leak Boeing SpaceX documents after contractor refuses to pay Targeting Manufacturers The DoppelPaymer Ransomware is the latest family threatening to sell or publish a victim's stolen files if they do not pay a ransom demand. UK research university Newcastle University says that it will take several weeks to get IT services back online after DoppelPaymer ransomware operators breached its network and took systems offline on the morning of August 30th. a major US IT and cybersecurity provider and one of NASA IT contractors. hit by ransomware https://illinoisattorneygeneral.gov/pressroom/2021_04/20210413.html https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-gang-rebrands-as-the-grief-group/ https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-hits-newcastle-university-leaks-data/ https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-sells-victims-data-on-darknet-if-not-paid/ https://www.bleepingcomputer.com/news/security/foxconn-electronics-giant-hit-by-ransomware-34-million-ransom/ https://www.bleepingcomputer.com/news/security/georgia-county-voter-information-leaked-by-ransomware-gang/ https://www.bleepingcomputer.com/news/security/kia-motors-america-suffers-ransomware-attack-20-million-ransom/ https://www.bleepingcomputer.com/news/security/masterchef-big-brother-producer-hit-by-doppelpaymer-ransomware/ https://www.bleepingcomputer.com/news/security/nra-no-comment-on-russian-ransomware-gang-attack-claims/ https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-wipe-decryption-key-if-negotiator-hired/ https://www.cybereason.com/blog/grief-gangs-new-quadruple-extortion-scheme-doesnt-change-the-game https://www.esentire.com/security-advisories/grief-ransomware-gang-claims-41-new-victims-targeting-manufacturers-municipalities-service-companies-in-u-k-europe https://www.theregister.co.uk/2020/04/10/lockheed_martin_spacex_ransomware_leak/ https://www.zdnet.com/article/compal-the-second-largest-laptop-manufacturer-in-the-world-hit-by-ransomware/ https://www.zdnet.com/article/first-death-reported-following-a-ransomware-attack-on-a-german-hospital/ https://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/ the second-largest laptop manufacturer in the world

Introduction

In June 2019, CrowdStrike Intelligence observed a source code fork of BitPaymer and began tracking the new ransomware strain as DoppelPaymer. Further technical analysis revealed an increasing divergence between two versions of Dridex, with the new version dubbed DoppelDridex. Based on this evidence, CrowdStrike Intelligence assessed with high confidence that a new group split off from INDRIK SPIDER to form the adversary DOPPEL SPIDER. Following DOPPEL SPIDER’s inception, CrowdStrike Intelligence observed multiple BGH incidents attributed to the group, with the largest known ransomware demand being 250 BTC. Other demands were not nearly as high, suggesting that the group conducts network reconnaissance to determine the value of the victim organization.

Activities and Tactics

Country of Origin: 🇷🇺 Russia

Notable Campaigns

  • $20 million ransom
  • $34 million ransom
  • & Service Companies in U.K. & Europe
  • 2020-02
  • 2020-03
  • 2020-06
  • 2020-08
  • 2020-09
  • 2020-10
  • 2020-11
  • 2020-12
  • 2021-02
  • 2021-04
  • 2021-07
  • 2021-09
  • 2021-10
  • Big Brother producer hit by DoppelPaymer ransomware
  • Breach of the Illinois Attorney General’s Office
  • Compal
  • Death occurred after a patient was diverted to a nearby hospital after the Duesseldorf University Hospital suffered a ransomware attack.
  • DoppelPaymer ransomware gang rebrands as the Grief group
  • DopplePaymer ransomware gang claims to have breached DMI
  • Foxconn electronics giant hit by ransomware
  • Grief Gang’s New Quadruple Extortion Scheme Doesn’t Change the Game
  • Grief Ransomware Gang Claims 41 New Victims
  • Hall County in Georgia announced that they had suffered a ransomware attack that impacted their networks and phone systems.
  • Kia Motors America suffers ransomware attack
  • Lockheed Martin
  • MasterChef
  • Municipalities
  • NRA: No comment on Russian ransomware gang attack claims
  • On October 7th
  • Ransomware gang threatens to wipe decryption key if negotiator hired
  • Ransomware scumbags leak Boeing
  • SpaceX documents after contractor refuses to pay
  • Targeting Manufacturers
  • The DoppelPaymer Ransomware is the latest family threatening to sell or publish a victim’s stolen files if they do not pay a ransom demand.
  • UK research university Newcastle University says that it will take several weeks to get IT services back online after DoppelPaymer ransomware operators breached its network and took systems offline on the morning of August 30th.
  • a major US IT and cybersecurity provider
  • and one of NASA IT contractors.
  • hit by ransomware
  • https://illinoisattorneygeneral.gov/pressroom/2021_04/20210413.html
  • https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-gang-rebrands-as-the-grief-group/
  • https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-hits-newcastle-university-leaks-data/
  • https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-sells-victims-data-on-darknet-if-not-paid/
  • https://www.bleepingcomputer.com/news/security/foxconn-electronics-giant-hit-by-ransomware-34-million-ransom/
  • https://www.bleepingcomputer.com/news/security/georgia-county-voter-information-leaked-by-ransomware-gang/
  • https://www.bleepingcomputer.com/news/security/kia-motors-america-suffers-ransomware-attack-20-million-ransom/
  • https://www.bleepingcomputer.com/news/security/masterchef-big-brother-producer-hit-by-doppelpaymer-ransomware/
  • https://www.bleepingcomputer.com/news/security/nra-no-comment-on-russian-ransomware-gang-attack-claims/
  • https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-wipe-decryption-key-if-negotiator-hired/
  • https://www.cybereason.com/blog/grief-gangs-new-quadruple-extortion-scheme-doesnt-change-the-game
  • https://www.esentire.com/security-advisories/grief-ransomware-gang-claims-41-new-victims-targeting-manufacturers-municipalities-service-companies-in-u-k-europe
  • https://www.theregister.co.uk/2020/04/10/lockheed_martin_spacex_ransomware_leak/
  • https://www.zdnet.com/article/compal-the-second-largest-laptop-manufacturer-in-the-world-hit-by-ransomware/
  • https://www.zdnet.com/article/first-death-reported-following-a-ransomware-attack-on-a-german-hospital/
  • https://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/
  • the second-largest laptop manufacturer in the world

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • PowerShell Empire:
  • Cobalt Strike:
  • PsExec:
  • Mimikatz:
  • BitPaymer ransomware:
  • DoppelDridex:
  • DoppelPaymer:
  • Grief:

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

References pending cataloguing.