April 23, 2020 By David Bisson 2 min read

DoppelPaymer ransomware operators demanded 100 bitcoins as ransom from officials after allegedly attacking the city of Torrance in California’s Los Angeles County.

Bleeping Computer reported that an update with the title “City of Torrance, CA” appeared on Dopple Leaks, the leak site created by DoppelPaymer’s operators. The post claimed to provide links to financial records, accounting documents and other files that malicious actors had allegedly stolen in a digital attack against Torrance that first made headlines in March 2020. According to CBS2/KCAL2, this attack compromised some city business services after affecting email accounts and servers owned by the municipality. City officials said that the incident had not exposed “public personal data,” however.

DoppelPaymer’s handlers clarified the scope of their alleged attack against Torrance in an email conversation with Bleeping Computer. They told the computer self-help website that they had erased the municipality’s backups, encrypted 650 IT assets and stolen more than 200 GB worth of information. They also pointed out that they had issued a ransom demand of 100 bitcoins (worth nearly $700,000 at the time of writing) in exchange for removing the files it had already posted online, agreeing to not publish any more data and providing Torrance officials with a decryptor.

Just the Latest DoppelPaymer Attack Campaign

The incident described above is just the latest operation involving DoppelPaymer. Researchers at CrowdStrike first spotted the ransomware in June 2019. In their analysis, researchers found that the threat had reused much of the code employed by BitPaymer, another ransomware family operated by the INDRIK SPIDER threat group.

It wasn’t until February 2020 when Bleeping Computer revealed that those behind the crypto-malware had created Dopple Leaks for the purpose of publishing the information of their non-compliant victims. Just a few days after that, TechCrunch reported that a contractor for Boeing, Tesla and others had confirmed an attack involving this malware family.

How to Defend Against a Ransomware Attack

Security professionals can help defend their municipalities and organizations against an attack at the hands of DoppelPaymer and other ransomware by implementing proactive defenses such as multifactor authentication (MFA) on their systems. These security controls will make it more difficult for attackers to establish an initial foothold for the ultimate purpose of moving laterally on the network.

Additionally, infosec personnel should work to prevent a ransomware infection in the first place by using threat intelligence to stay on top of the latest attack campaigns.

More from

Poland spending $760 million on cybersecurity after attack

3 min read - Visitors to the Polish Press Agency (PAP) website on May 31 at 2 p.m. Polish time were met with an unusual message. Instead of the typical daily news, the state-run newspaper had supposedly published a story announcing that a partial mobilization, which means calling up specific people to serve in the armed forces, was ordered by Polish Prime Minister Donald Tusk beginning on July 1, 2024. Deputy Prime Minister Krzysztof Gawkowski refuted the claim on X (formerly Twitter). His post…

How generative AI Is expanding the insider threat attack surface

3 min read - As the adoption of generative AI (GenAI) soars, so too does the risk of insider threats. This puts even more pressure on businesses to rethink security and confidentiality policies.In just a few years, artificial intelligence (AI) has radically changed the world of work. 61% of knowledge workers now use GenAI tools — particularly OpenAI’s ChatGPT — in their daily routines. At the same time, business leaders, often partly driven by a fear of missing out, are investing billions in tools…

Water facilities warned to improve cybersecurity

3 min read - United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today