April 23, 2020 By David Bisson 2 min read

DoppelPaymer ransomware operators demanded 100 bitcoins as ransom from officials after allegedly attacking the city of Torrance in California’s Los Angeles County.

Bleeping Computer reported that an update with the title “City of Torrance, CA” appeared on Dopple Leaks, the leak site created by DoppelPaymer’s operators. The post claimed to provide links to financial records, accounting documents and other files that malicious actors had allegedly stolen in a digital attack against Torrance that first made headlines in March 2020. According to CBS2/KCAL2, this attack compromised some city business services after affecting email accounts and servers owned by the municipality. City officials said that the incident had not exposed “public personal data,” however.

DoppelPaymer’s handlers clarified the scope of their alleged attack against Torrance in an email conversation with Bleeping Computer. They told the computer self-help website that they had erased the municipality’s backups, encrypted 650 IT assets and stolen more than 200 GB worth of information. They also pointed out that they had issued a ransom demand of 100 bitcoins (worth nearly $700,000 at the time of writing) in exchange for removing the files it had already posted online, agreeing to not publish any more data and providing Torrance officials with a decryptor.

Just the Latest DoppelPaymer Attack Campaign

The incident described above is just the latest operation involving DoppelPaymer. Researchers at CrowdStrike first spotted the ransomware in June 2019. In their analysis, researchers found that the threat had reused much of the code employed by BitPaymer, another ransomware family operated by the INDRIK SPIDER threat group.

It wasn’t until February 2020 when Bleeping Computer revealed that those behind the crypto-malware had created Dopple Leaks for the purpose of publishing the information of their non-compliant victims. Just a few days after that, TechCrunch reported that a contractor for Boeing, Tesla and others had confirmed an attack involving this malware family.

How to Defend Against a Ransomware Attack

Security professionals can help defend their municipalities and organizations against an attack at the hands of DoppelPaymer and other ransomware by implementing proactive defenses such as multifactor authentication (MFA) on their systems. These security controls will make it more difficult for attackers to establish an initial foothold for the ultimate purpose of moving laterally on the network.

Additionally, infosec personnel should work to prevent a ransomware infection in the first place by using threat intelligence to stay on top of the latest attack campaigns.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today