DoppelPaymer ransomware operators demanded 100 bitcoins as ransom from officials after allegedly attacking the city of Torrance in California’s Los Angeles County.

Bleeping Computer reported that an update with the title “City of Torrance, CA” appeared on Dopple Leaks, the leak site created by DoppelPaymer’s operators. The post claimed to provide links to financial records, accounting documents and other files that malicious actors had allegedly stolen in a digital attack against Torrance that first made headlines in March 2020. According to CBS2/KCAL2, this attack compromised some city business services after affecting email accounts and servers owned by the municipality. City officials said that the incident had not exposed “public personal data,” however.

DoppelPaymer’s handlers clarified the scope of their alleged attack against Torrance in an email conversation with Bleeping Computer. They told the computer self-help website that they had erased the municipality’s backups, encrypted 650 IT assets and stolen more than 200 GB worth of information. They also pointed out that they had issued a ransom demand of 100 bitcoins (worth nearly $700,000 at the time of writing) in exchange for removing the files it had already posted online, agreeing to not publish any more data and providing Torrance officials with a decryptor.

Just the Latest DoppelPaymer Attack Campaign

The incident described above is just the latest operation involving DoppelPaymer. Researchers at CrowdStrike first spotted the ransomware in June 2019. In their analysis, researchers found that the threat had reused much of the code employed by BitPaymer, another ransomware family operated by the INDRIK SPIDER threat group.

It wasn’t until February 2020 when Bleeping Computer revealed that those behind the crypto-malware had created Dopple Leaks for the purpose of publishing the information of their non-compliant victims. Just a few days after that, TechCrunch reported that a contractor for Boeing, Tesla and others had confirmed an attack involving this malware family.

How to Defend Against a Ransomware Attack

Security professionals can help defend their municipalities and organizations against an attack at the hands of DoppelPaymer and other ransomware by implementing proactive defenses such as multifactor authentication (MFA) on their systems. These security controls will make it more difficult for attackers to establish an initial foothold for the ultimate purpose of moving laterally on the network.

Additionally, infosec personnel should work to prevent a ransomware infection in the first place by using threat intelligence to stay on top of the latest attack campaigns.

More from

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…