Besides using stolen files as leverage to force victims into paying ransoms as they did in NWO's case, DoppelPaymer ransomware operators threatened to wipe decryption keys if victims contracted professional negotiators to obtain a better price for recovering the encrypted data. Moldovan authorities have detained a 45-year-old suspect linked to DoppelPaymer ransomware attacks targeting Dutch organizations in 2021. A Monday press release added that the suspect, described as a "foreign citizen," had allegedly orchestrated a 2021 ransomware attack against the NWO (Dutch Research Council) that led to roughly €4.5 million in damages. The DoppelPaymer ransomware operation emerged in June 2019 after the Evil Corp cybercrime gang split, with some members creating a new ransomware gang that shared much of the same code as Evil Corp's BitPaymer. Law enforcement has targeted two other individuals believed to be core members of the DoppelPaymer ransomware group in March 2023 and issued arrest warrants for three other core members. DoppelPaymer continued to attack large companies and critical infrastructure organizations through 2022, rebranding twice as Grief (a.k.a. Pay or Grief) and Entropy ransomware. The gang's victims list includes high-profile companies and organizations worldwide, such as electronics giant Foxconn, Kia Motors America, Delaware County in Pennsylvania, laptop maker Compal, and Newcastle University. Police officers searched the suspect's home and car on May 6, seizing an electronic wallet, €84,800, two laptops, a mobile phone, a tablet, six bank cards, and multiple data storage devices. The arrest resulted from a joint action involving Moldovan prosecutors, the country's Center for Combating Cybercrimes, and law enforcement in the Kingdom of the Netherlands. Ten days later, the attackers published documents stolen from the council's network on DoppelPaymer's dark web leak site after the NWO refused to pay a ransom demand.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 12 May 2025 15:19:54 +0000