Tag Archive for: DoppelPaymer

FBI Warns of DoppelPaymer Ransomware Attack Surge

/in


Fraud Management & Cybercrime
,
Ransomware

Cybercriminals Are Using Phone Calls to Pressure Victims

Prajeet Nair (@prajeetspeaks) •
December 18, 2020    

FBI Warns of DoppelPaymer Ransomware Attack Surge

The FBI is warning of increased activity – including disruption of a police dispatch system – by the operators of DoppelPaymer, a ransomware variant linked to high-profile attacks over the last several months.

See Also: Protecting from Ransomware Attacks with DNS

The operators of DoppelPaymer, or their affiliates, have been calling victims as a way of pressuring them to pay ransoms, which can be as high as seven figures, the FBI reports in a notice made public this week.

“As of February 2020, in multiple instances, DoppelPaymer actors had followed ransomware infections with calls to the victims to extort payments through intimidation or threatening to release exfiltrated data,” the FBI alert notes. “In one case, an actor, using a spoofed U.S.-based telephone number while claiming to be located in North Korea, threatened to leak or sell data from an identified business if the business did not pay the ransom.”

First spotted in 2019 as an offshoot of the cybercrime operation called Evil Corp, DoppelPaymer – which appears to be a variant of BitPaymer – has previously hit several high-profile targets, including Mexico’s state-run oil company Pemex and Chile’s Ministry of Agriculture, according to cybersecurity analysts.

The DoppelPaymer gang demands ransoms of $25,000 to $1.2 million in bitcoin, according to a previous report by security firm CrowdStrike (see: DoppelPaymer Ransomware Gang Threatens to Dump Victims’ Data ).

The operators of DoppelPaymer and their affiliates not only use crypto-locking malware to encrypt files within targeted networks but also exfiltrate data in an attempt to extort payments from…

Source…

Pennsylvania county pays 500K ransom to DoppelPaymer ransomware

/in


DoppelPaymer

Delaware County, Pennsylvania has paid a $500,000 ransom after their systems were hit by the DoppelPaymer ransomware last weekend.

On Monday, Delaware County disclosed that they had taken portions of their computer network offline after discovering that their network was compromised.

“The County of Delaware recently discovered a disruption to portions of its computer network. We commenced an immediate investigation that included taking certain systems offline and working with computer forensic specialists to determine the nature and scope of the event. We are working diligently to restore the functionality of our systems,” the Delaware County alert stated.

The County stated that the Bureau of Elections and the County’s Emergency Services Department were not affected and are on a different network than the hacked systems.

Local media has stated that the ransomware operators had access to networks containing police reports, payroll, purchasing, and other databases. As part of the attack, the threat actors demanded a $500,000 ransom to receive a decryptor.

“Sources said the county is in the process of paying the $500,000 ransom as it’s insured for such attacks,” Philadelphia’s 6abc’s Action News reported.

DoppelPaymer gang behind attack

Since then, sources have told BleepingComputer that the DoppelPaymer ransomware gang was behind the attack and that Delaware County had paid the ransom.

DoppelPaymer dervices its name from BitPaymer, which shares a large portion of code, but has been improved over time with a threaded encryption process for faster operation.

DoppelPaymer is known to steal unencrypted files when performing their attacks. It is not known if this was done in the attack against Delaware County.

BleepingComputer was also told that the ransomware gang advised Delaware County to change all of their passwords and modify their Windows domain configuration to include safeguards from the Mimikatz program.

Mimikatz is an open-source application commonly used by ransomware gangs to harvest Windows domain credentials on a compromised network.

Mimikatz extracting NTLM hashes
Mimikatz extracting NTLM hashes
Source: Mimikatz Github page

Once the threat actors gain access to a Windows domain administrator…

Source…