DoppelPaymer hackers visited by police in Germany, Ukraine
Suspected DoppelPaymer ransomware operators have had their equipment seized to determine what role, if any, they played in the gang.
Image by Europol.
Suspected DoppelPaymer ransomware operators have had their equipment seized to determine what role, if any, they played in the gang.
German and Ukrainian authorities simultaneously raided the homes of individuals suspected to be core members of the DoppelPaymer ransomware gang, Europol announced.
DoppelPaymer is believed to be related to the notorious Russian cybercriminal group Evil Corp, sanctioned by the US Treasury since 2019.
“Investigators are currently analyzing the seized equipment to determine the suspect’s exact role in the structure of the ransomware group,” Europol said.
Meanwhile, Ukrainian police interrogated a Ukrainian national, also suspected to be a core member of the DoppelPaymer ransomware group. Despite the ongoing war with Russia, Ukrainian authorities searched locations in Kyiv and Kharkiv.
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
According to Mark Lamb, the CEO of cybersecurity firm HighGround, DoppelPaymer has been causing havoc and costing organizations millions for over three years.
“The seized infrastructure should provide significantly more intelligence to law enforcement, and it’s likely others behind the threat will face the heavy hand of the law very soon,” Lamb said.
DoppelPaymer was first discovered in 2019, its activities peaking during the first year of the COVID-19 pandemic and prompting the FBI to issue a warning about the ransomware syndicate.
Researchers at TrendMicro claim that DoppelPaymer demanded victims pay hefty sums, ranging from $25,000 to $1.2 million, for file decryption software. Threat actors threatened to leak the data if victims didn’t pay the ransom.
According to Europol, German authorities are aware of 37 DoppelPaymer victims. It is estimated that US victims have paid DoppelPaymer over $40 million in total.
DoppelPaymer rebranded as Grief ransomware in 2021. Ransomware gangs frequently change names to avoid attention from law enforcement authorities.
According to deep-web watchdog Darkfeed, Grief ransomware victimized 96 organizations over its lifetime. In 2021, the gang targeted the National Rifle Association of America, a controversial US-based gun lobby group.