DoppelPaymer
DoppelPaymer is a human-operated ransomware family and extortion operation first appearing in July 2019. It is described as using similar tactics and much of the same code as BitPaymer, and reporting in the provided content says it is thought to have emerged after a split from the BitPaymer group. The malware is associated with double-extortion operations: operators steal data before encrypting systems and then threaten to publish or sell the stolen material if the victim does not pay. The group launched a leak site in February 2020 referred to as “Dopple Leaks,” and the content notes that it later published victim data there.
The provided reporting states that DoppelPaymer has targeted victims via RDP compromise and access provided by the Dridex trojan. Additional content links delivery of DoppelPaymer payloads in some intrusions to Qbot/QakBot-infected environments, including activity involving the Lockean affiliate cluster and TA551. CERT-FR reporting cited in the content says Lockean first deployed DoppelPaymer against a French manufacturing company in 2020, and that TA551 helped Lockean affiliates drop DoppelPaymer, ProLock, and Egregor on devices infected with Qbot/QakBot.
Capabilities and behavior directly described in the content include encrypting large numbers of servers, stealing unencrypted files prior to encryption, destroying backup data, and publishing stolen files on a ransomware leak site to increase pressure on victims. The content also notes DoppelPaymer’s use of process kill lists alongside other ransomware families in research on financially motivated actors targeting operational technology environments.
A prominently documented incident in the provided material involved Foxconn’s CTBG MX facility in Ciudad Juárez, Mexico, around late November 2020. In that case, DoppelPaymer operators claimed they attacked Foxconn’s North America facility, encrypted roughly 1,200 to 1,400 servers, stole about 100 GB of data, destroyed 20 to 30 TB of backup data, and demanded 1804.0955 BTC, valued at about $34.7 million at the time. Reporting also states that files linked to Foxconn NA were later published on DoppelPaymer’s leak site, though one report said the leaked material consisted of generic business documents and reports rather than financial or employee personal data. Another supply-chain-related incident in the content involved Visser Precision, where stolen documents related to customers including Lockheed Martin, SpaceX, and Tesla were published, illustrating the group’s use of leaked customer-linked data for extortion pressure.
Victims and sectors explicitly mentioned in the content include manufacturing, electronics, aerospace and automotive supply chains, telecommunications, universities, local government, and energy. Named victims or reported victims include Foxconn, Visser Precision, Bretagne Télécom, Compal, the City of Torrance, Hall County in Georgia, Newcastle University, PEMEX, and Banijay Group SAS. The content also references Delaware County paying a $500,000 ransom following a DoppelPaymer attack in 2020.
The content further associates DoppelPaymer with broader cybercrime ecosystems and actor relationships. It states that Grief is an offshoot of the DoppelPaymer group and that DoppelPaymer evolved from EvilCorp, according to cited reporting. It also notes law-enforcement activity against DoppelPaymer affiliates, including references to government counter-ransomware actions and the arrest of a DoppelPaymer affiliate in 2025.
High-confidence indicators and artifacts directly mentioned in the content include the “Dopple Leaks” leak site name, the Foxconn ransom demand of 1804.0955 BTC, and the Foxconn incident claims of 100 GB stolen, 1,200 to 1,400 servers encrypted, and 20 to 30 TB of backups destroyed.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The company’s Mexico operations were previously hit with a ransomware attack in 2020 by the DoppelPaymer gang, which demanded a $34 million ransom... The group stole about 100 GB of files.
Grief is an offshoot of the DoppelPaymer ransomware group that evolved from EvilCorp, said Gershuni.
Lockean activity was first noticed in 2020 when the actor hit a French company in the manufacturing sector and deployed DoppelPaymer ransomware on the network.
"...QakBot infections have led to the deployment of ransomware, including ... DoppelPaymer..."
In Moldova, authorities arrested a 45-year-old foreign national linked to the 2021 DoppelPaymer ransomware attack on Dutch organizations...
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Credential Access
1 technique"...found a variety of sensitive data including usernames and passwords, IP addresses, remote services..."
Discovery
1 techniqueFireEye Mandiant originally explored the link between financially motivated actors and OT in July 2020, when researchers found process kill lists deployed alongside seven different ransomware families... The second kill list was deployed alongside Clop ransomware.
Lateral Movement
1 techniqueCollection
1 techniqueThey threatened to leak the data stolen during the attack by June 11.
Exfiltration
4 techniques"...disclosing terabytes of stolen information on shaming sites... we downloaded and parsed through many terabytes of dump data and found a substantial amount of sensitive OT documentation."
The group stole about 100 GB of files. Foxconn did not pay the exorbitant ransom and some of the data was leaked on the dark web.
The company is ranked 28th in Fortune Global 500 and manufactures a wide range of electronic products for major tech companies worldwide... The incident was confirmed ... claims by the Nitrogen ransomware operation earlier this week that they had stolen 8 TB of data and more than 11 million documents.
LockBit ransomware operation claimed the attack on May 31 by publishing a threat to leak data stolen from Foxconn unless a ransom is paid by June 11.
Impact
5 techniquesAfter the ransomware attack, the website of the Mexican facility went down, and the attackers claimed to have destroyed approximately 20-30TB of data.
Tech manufacturing giant Foxconn said its factory in Mexico is slowly returning to normal after a ransomware attack crippled the facility in May.
The attackers asked for a $34 million ransom and claimed to have stolen 100GB of data, encrypted between 1,200 and 1,400 servers and destroyed 20 to 30TB of backup data.
The process kill lists were designed to amplify the effects of known ransomware strains.
DoppelPaymer has only started publishing data in the last few days... the group claims to have sold data stolen in previous incidents on the dark web.
Other
2 techniquesAdversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.
Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities... killing security software processes or services, modifying / deleting Registry keys or configuration files... Adversaries may also disable updates...
Recent activity
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DoppelPaymer is referenced as a ransomware family previously involved in attacks targeting Foxconn.
Ransomware family/group referenced as previously targeting a Foxconn plant and demanding a large ransom payment.
Ransomware operation that allegedly attacked a Foxconn facility, stole data, encrypted servers, and destroyed backup data.
Ransomware payload dropped by Lockean affiliates on systems infected via Qbot/QakBot with TA551 collaboration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.