DoppelPaymer ransomware operators demanded 100 bitcoins as ransom from officials after allegedly attacking the city of Torrance in California’s Los Angeles County.
Bleeping Computer reported that an update with the title “City of Torrance, CA” appeared on Dopple Leaks, the leak site created by DoppelPaymer’s operators. The post claimed to provide links to financial records, accounting documents and other files that malicious actors had allegedly stolen in a digital attack against Torrance that first made headlines in March 2020. According to CBS2/KCAL2, this attack compromised some city business services after affecting email accounts and servers owned by the municipality. City officials said that the incident had not exposed “public personal data,” however.
DoppelPaymer’s handlers clarified the scope of their alleged attack against Torrance in an email conversation with Bleeping Computer. They told the computer self-help website that they had erased the municipality’s backups, encrypted 650 IT assets and stolen more than 200 GB worth of information. They also pointed out that they had issued a ransom demand of 100 bitcoins (worth nearly $700,000 at the time of writing) in exchange for removing the files it had already posted online, agreeing to not publish any more data and providing Torrance officials with a decryptor.
Just the Latest DoppelPaymer Attack Campaign
The incident described above is just the latest operation involving DoppelPaymer. Researchers at CrowdStrike first spotted the ransomware in June 2019. In their analysis, researchers found that the threat had reused much of the code employed by BitPaymer, another ransomware family operated by the INDRIK SPIDER threat group.
It wasn’t until February 2020 when Bleeping Computer revealed that those behind the crypto-malware had created Dopple Leaks for the purpose of publishing the information of their non-compliant victims. Just a few days after that, TechCrunch reported that a contractor for Boeing, Tesla and others had confirmed an attack involving this malware family.
How to Defend Against a Ransomware Attack
Security professionals can help defend their municipalities and organizations against an attack at the hands of DoppelPaymer and other ransomware by implementing proactive defenses such as multifactor authentication (MFA) on their systems. These security controls will make it more difficult for attackers to establish an initial foothold for the ultimate purpose of moving laterally on the network.
Additionally, infosec personnel should work to prevent a ransomware infection in the first place by using threat intelligence to stay on top of the latest attack campaigns.