Ransomware needs a way in. Stolen credentials are the cheapest one.
doommageddon Ransomware Group
Ransomware group profile
Description
Doommageddon is a ransomware group that emerged in July 2026, utilizing a double-extortion model that combines file encryption and data exfiltration. The group targets various sectors, leveraging sophisticated tactics such as social engineering and advanced malware to maximize financial gain from its victims.
Key insights
- •Utilizes RSA-2048 asymmetric encryption to append the .doomag extension to files.
- •Employs social engineering phishing campaigns and exploits network vulnerabilities for initial access.
- •Implements a structured Tor-based data leak site categorizing victim negotiation statuses.
- •Enforces double extortion by publicly threatening to release sensitive data if ransoms are not paid.
- •Communicates with victims through the Session messaging application for direct ransom negotiations.
Threat Level & Status Breakdown
For doommageddon · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for doommageddon in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for doommageddon
T1562
Impair Defenses
T1059
Command and Scripting Interpreter
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1080
Taint Shared Content
T1021.001
Remote Desktop Protocol
T1041
T1041
T1030
T1030
T1069
T1069
T1210
T1210
T1078
Valid Accounts
Victims(21)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| ENKA Schools | Turkey | Claimed | 1 day ago | |
| Cam Group LLC | United States | Claimed | 1 day ago | |
| Goodrich Logistics | India | Claimed | 9 days ago | |
| Chem Process Systems Pvt. Ltd. | India | Claimed | 8 days ago | |
| KOLORKIM KIMYA | Turkey | Data Leaked | 3 months ago | |
| Riskmetrica | — | Claimed | 11 days ago | |
| PAID | — | Claimed | 11 days ago | |
| Solventa & Riskmetrica | Paraguay | Claimed | 3 months ago | |
| Hospital Di Camp | Brazil | Claimed | 3 months ago | |
| Francisco Imóveis | Brazil | Data Leaked | 3 months ago | |
| iw steelTEC Makine San. ve Tic. A.Ş. | — | Claimed | 11 days ago | |
| Mercedes-Benz Turk | Turkey | Data Leaked | 3 months ago | |
| Innovano | India | Data Leaked | 3 months ago | |
| Solventa & Riskmetrica | Calificadora de Riesgos | — | Claimed | 11 days ago | |
| Reni Farmácias Associadas | — | Claimed | 11 days ago | |
| Charlottesville Police Department | United States | Claimed | 16 days ago | |
| INCOR Group | India | Claimed | 24 days ago | |
| SITTNAK Lojistik A.Ş. | Turkey | Claimed | about 1 month ago | |
| Akpera Gayrimenkul Yatırım A.Ş. | Turkey | Claimed | about 1 month ago | |
| Reni Farmácias | Brazil | Claimed | 3 months ago |
Page 1 of 2
Affected countries(10)
Countries where this group has been reported to target or leak victims.