Ransomware needs a way in. Stolen credentials are the cheapest one.
doommageddon Ransomware Group
Ransomware group profile
Description
Doommageddon is a ransomware group that emerged in July 2026, utilizing a double-extortion model that combines file encryption and data exfiltration. The group targets various sectors, leveraging sophisticated tactics such as social engineering and advanced malware to maximize financial gain from its victims.
Key insights
- •Utilizes RSA-2048 asymmetric encryption to append the .doomag extension to files.
- •Employs social engineering phishing campaigns and exploits network vulnerabilities for initial access.
- •Implements a structured Tor-based data leak site categorizing victim negotiation statuses.
- •Enforces double extortion by publicly threatening to release sensitive data if ransoms are not paid.
- •Communicates with victims through the Session messaging application for direct ransom negotiations.
Threat Level & Status Breakdown
For doommageddon · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for doommageddon in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for doommageddon
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1080
Taint Shared Content
T1021.001
Remote Desktop Protocol
T1041
T1041
T1030
T1030
T1069
T1069
T1210
T1210
T1078
Valid Accounts
Victims(11)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| INCOR Group | India | Claimed | 5 days ago | |
| SITTNAK Lojistik A.Ş. | Turkey | Claimed | 21 days ago | |
| Akpera Gayrimenkul Yatırım A.Ş. | Turkey | Claimed | 21 days ago | |
| Reni Farmácias | Brazil | Claimed | 2 months ago | |
| Hospital Di Camp | Brazil | Claimed | 2 months ago | |
| Solventa & Riskmetrica | Paraguay | Claimed | 3 months ago | |
| Francisco Imóveis | Brazil | Data Leaked | 3 months ago | |
| Innovano | India | Data Leaked | 3 months ago | |
| Mercedes-Benz Turk | Turkey | Data Leaked | 3 months ago | |
| KOLORKIM KIMYA | Turkey | Data Leaked | 3 months ago | |
| iw-steelTEC A.S. | Turkey | Data Leaked | about 2 months ago |
Affected countries(9)
Countries where this group has been reported to target or leak victims.