Threat Update: Dopple Leaks Shaming Website

Threat Update: Dopple Leaks Shaming Website

Based on the popularity of Maze Ransomware's name and shame technique of calling out victims that hadn't paid their ransom and releasing their content, a new site has appeared mirroring this tactic. DoppelPaymer, an offshoot of BitPaymer, has set up a Dopple Leaks site which is naming companies that haven't paid their ransom, and uploading the data that was stolen from these companies to the public.

Details

This new technique used by Ransomware authors has been growing in popularity lately due to the success that Maze has had, and will most likely continue to grow in an effort for attackers to get more money from their victims. Companies have two choices when hit with a ransomware attack, pay the ransom and hope the attackers keep their word and provide a valid decryption key, and that they don't still leak your data, or they can not pay the ransom and hope for the best. Ransomware authors started using this technique in order to show they mean business and will most certainly leak your data if you don't pay the ransom.

By proving they will upload your data, it's somewhat of a reassurance to victims that if they do indeed pay the ransom, their data will not get exposed and they'll be "fine" (remediation and cleanup of this attack will involve a lot of work, but they won't have all their data exposed for everyone to see). This is not guaranteed though, which is why it's so hard for victims to make the decision to pay or not. Lastly, it also makes sense for the ransomware creators to keep their word, since if a company paid the ransom and the attackers still released their data, it may persuade other victims to not pay since they'll still release the data. This incentivizes the attackers to keep their word to ensure they keep getting money from victims.

This new site has been around only for a week, with the first victim, Sekure Merchants, posted on 02-21-2020, with three more victims posted over the next three days, including Bidvest Panalpina Logistics, Bretagne Telecom, and Pemex.

Figure 1. Dopple Leaks site showing victim data

On 02-26-2020, a Twitter account potentially associated with DoppelPaymer @DoppelPaymer, tweeted that there are much larger breaches coming soon, including Tesla, SpaceX, and Boeing.

Figure 2. Tweet from DoppelPaymer announcing potential new breaches

Conclusion

There is a lot to consider when hit with a ransomware attack and sites like this don't make the decision any easier, however, it's something new for your executive team to consider when making the decision to pay the ransom or not. This type of extortion can at least identify the worst-case scenario in your response process, since you know with a certain degree that if you don't pay, all your data would potentially become public, which is often the worst fear of any company. Even if you have a robust backup process in place and can restore all of your data with no issue, the risk is still there that the data will be leaked, and with the popularity of these sites, it's bound to get some publicity and could be harmful to victims.