April 23, 2020 By David Bisson 2 min read

DoppelPaymer ransomware operators demanded 100 bitcoins as ransom from officials after allegedly attacking the city of Torrance in California’s Los Angeles County.

Bleeping Computer reported that an update with the title “City of Torrance, CA” appeared on Dopple Leaks, the leak site created by DoppelPaymer’s operators. The post claimed to provide links to financial records, accounting documents and other files that malicious actors had allegedly stolen in a digital attack against Torrance that first made headlines in March 2020. According to CBS2/KCAL2, this attack compromised some city business services after affecting email accounts and servers owned by the municipality. City officials said that the incident had not exposed “public personal data,” however.

DoppelPaymer’s handlers clarified the scope of their alleged attack against Torrance in an email conversation with Bleeping Computer. They told the computer self-help website that they had erased the municipality’s backups, encrypted 650 IT assets and stolen more than 200 GB worth of information. They also pointed out that they had issued a ransom demand of 100 bitcoins (worth nearly $700,000 at the time of writing) in exchange for removing the files it had already posted online, agreeing to not publish any more data and providing Torrance officials with a decryptor.

Just the Latest DoppelPaymer Attack Campaign

The incident described above is just the latest operation involving DoppelPaymer. Researchers at CrowdStrike first spotted the ransomware in June 2019. In their analysis, researchers found that the threat had reused much of the code employed by BitPaymer, another ransomware family operated by the INDRIK SPIDER threat group.

It wasn’t until February 2020 when Bleeping Computer revealed that those behind the crypto-malware had created Dopple Leaks for the purpose of publishing the information of their non-compliant victims. Just a few days after that, TechCrunch reported that a contractor for Boeing, Tesla and others had confirmed an attack involving this malware family.

How to Defend Against a Ransomware Attack

Security professionals can help defend their municipalities and organizations against an attack at the hands of DoppelPaymer and other ransomware by implementing proactive defenses such as multifactor authentication (MFA) on their systems. These security controls will make it more difficult for attackers to establish an initial foothold for the ultimate purpose of moving laterally on the network.

Additionally, infosec personnel should work to prevent a ransomware infection in the first place by using threat intelligence to stay on top of the latest attack campaigns.

More from

Widespread exploitation of recently disclosed Ivanti vulnerabilities

6 min read - IBM X-Force has assisted several organizations in responding to successful compromises involving the Ivanti appliance vulnerabilities disclosed in January 2024. Analysis of these incidents has identified several Ivanti file modifications that align with current public reporting. Additionally, IBM researchers have observed specific attack techniques involving the theft of authentication token data not readily noted in current public sources. The blog details the results of this research to assist organizations in protecting against these threats. Key Findings: IBM research teams have…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

How I got started: Cyber AI/ML engineer

3 min read - As generative AI goes mainstream, it highlights the increasing demand for AI cybersecurity professionals like Maria Pospelova. Pospelova is currently a senior data scientist, and data science team lead at OpenText Cybersecurity. She also worked at Interest, an AI cybersecurity company acquired by MicroFocus and then by OpenText. She continues as part of that team today.Did you go to college? What did you go to school for?Pospelova: I graduated with a bachelor’s degree in computer science and a master’s degree…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today