doppelpaymer

DoppelPaymer ransomware is attributed to the Russia-based Evil Corp cybercriminal organization and is a successor to BitPaymer ransomware. Active from 2019 to mid-2021, the group targeted hospitals, government entities, and large enterprises including Newcastle University and Kia Motors. DoppelPaymer rebranded as Grief (also spelled Greif) in May 2021, likely to circumvent US Treasury sanctions imposed on Evil Corp in 2019.