doommageddon Ransomware Group
Ransomware group profile
Description
Doommageddon is a ransomware group that emerged in July 2026, utilizing a double-extortion model that combines file encryption and data exfiltration. The group targets various sectors, leveraging sophisticated tactics such as social engineering and advanced malware to maximize financial gain from its victims.
Key insights
- •Utilizes RSA-2048 asymmetric encryption to append the .doomag extension to files.
- •Employs social engineering phishing campaigns and exploits network vulnerabilities for initial access.
- •Implements a structured Tor-based data leak site categorizing victim negotiation statuses.
- •Enforces double extortion by publicly threatening to release sensitive data if ransoms are not paid.
- •Communicates with victims through the Session messaging application for direct ransom negotiations.
Threat Level & Status Breakdown
For doommageddon · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for doommageddon in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for doommageddon
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1080
Taint Shared Content
T1021.001
Remote Desktop Protocol
T1041
T1041
T1030
T1030
T1069
T1069
T1210
T1210
T1078
Valid Accounts
Victims(8)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Reni Farmácias | Brazil | Claimed | 20 days ago | |
| Hospital Di Camp | Brazil | Claimed | 30 days ago | |
| Solventa & Riskmetrica | Paraguay | Claimed | about 1 month ago | |
| Francisco Imóveis | Brazil | Data Leaked | about 1 month ago | |
| Innovano | India | Data Leaked | about 1 month ago | |
| Mercedes-Benz Turk | Turkey | Data Leaked | about 1 month ago | |
| KOLORKIM KIMYA | Turkey | Data Leaked | about 1 month ago | |
| iw-steelTEC A.S. | Turkey | Data Leaked | 14 days ago |
Affected countries(9)
Countries where this group has been reported to target or leak victims.