DopplePaymer Ransomware Attacks on Critical Infrastructure

Summary

Since late August 2019, unidentified actors have used DoppelPaymer ransomware to encrypt data from victims within critical industries worldwide such as healthcare, emergency services, and education, interrupting citizens’ access to services. Since its emergence in June2019, DoppelPaymer ransomware has infected a variety of industries and targets, with actors routinely demanding six-and seven-figure ransoms in Bitcoin(BTC) . Prior to infecting systems with ransomware, the actors’ exfiltrate data to use in extortion schemes and have made follow-on telephone calls to victims to further pressure them to make ransom payments.

This FBI PIN contains an overview of the threat, additional tactics, techniques, and procedures, recommended mitigations, and is being provided to assist cybersecurity professionals guard against the persistent malicious actions of cyber actors.

Reporting

We encourage recipients who discover signs of malicious cyber activity to contact us via the cyber incident report form here.