Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Threat Actors doommageddon

Also known as: tracked as, APT43, Bjorka, SkyWave, quic, Colddraw Ransomware, built a, OffSec, Lolkek, medium-sized, medium-sized bu, targeting nume, Dispossessor, active since August 2023, RA World, Raznatovic, Linux VMware, 54BB47h, Fonix, Gamaredon APT, Abyss Locker, ARCrypter, GlobeImposter, CosmicBeetle, PlayCrypt, N13V, operated by UNC2190, FonixCrypter

Description

Doommageddon orchestrates attacks that blend ransomware delivery with a "data‑dump‑first" double extortion strategy. Their operations begin with carefully crafted spearphishing emails that deliver malicious Office templates or Outlook VBA attachments, enabling initial persistence via Run key registry entries and script execution. Once inside, the malware deploys obfuscated PowerShell, VBScript, and batch payloads; it then scans for Office documents on mapped drives and USB volumes and exfiltrates these files over HTTP/HTTPS channels controlled through fast‑flux DNS zones. The group’s toolkit includes self‑extracting archives (7z), hidden console utilities such as hidcon, and legitimate system binaries (rundll32, mshta.exe) used to mask malicious activity. It also leverages remote control via UltraVNC and creates scheduled tasks for persistence while taking frequent screenshots and deleting local copies of exfiltrated data to reduce forensic footprints. Doommageddon’s operations are coordinated through cloud or VPS infrastructure, sometimes employing geoblocking to limit payload downloads by region. The actor is known to use repetitive TLS certificates across its infrastructure, Base64‑encoded download scripts, and obfuscated driver files (.drv) to evade detection. Their campaign footprint includes numerous industries—financial services, healthcare, government, transportation, and critical infrastructure—demonstrating a broad targeting range with opportunistic selection of high-value victims.

Goals & Targeting

Objectives

Ransomware
Financial Gain

Targeted Sectors

Financial services
Healthcare
Government
Defense
Transportation
Construction
Telecommunications
Manufacturing
Energy
Hospitality
Critical infrastructure
Education
Retail
Non profit
Oil gas
Information technology
Legal services
Media
Food agriculture
Aerospace
Maritime
Entertainment

Targeted Countries / Regions

US
BR
UA
RU
TR
CA
AU
FR
IN
PK
IL
IR
DE
GB
SG
NL
ES
IT

AI Analysis

Grounded in web research
· analyzed in 2 chunks · 2 days ago

Executive Summary

Doommageddon is a medium‑sophistication ransomware group that uses double extortion tactics to target a wide array of sectors globally. Leveraging cloud hosting, fast‑flux DNS, and malicious Office macros, they execute sophisticated phishing campaigns, exfiltrate data quietly, and demand ransom for both encrypted files and leaked information.

Goals & Targeting

The group’s primary objective is financial gain via ransomware revenue augmented by a double‑extortion model that exploits both encrypted data and exfiltrated sensitive information. By targeting a wide spectrum of industries—including critical infrastructure, healthcare, finance, and government—Doommageddon seeks to maximize leverage over compromised organizations, increasing the likelihood of ransom payment. Their consistent use of geographically restricted payload delivery also hints at an awareness of regulatory environments and an intent to avoid overtly high‑risk regions.

Enhanced Description

Key Capabilities

  • Cloud or VPS hosting for infrastructure
  • Obfuscated PowerShell, VBScript, and batch scripts for staging and execution
  • Persistence via Run key registry entries
  • Scanning and exfiltration of Office documents from mapped drives and USB volumes
  • Malicious macros in Word/Excel templates and Outlook VBA projects
  • Execution of VBScript through wscript.exe
  • Fast‑flux DNS (including low‑frequency single‑flux) for C2
  • Taunting images or messages left on victim desktops
  • File/folder deletion during cleanup
  • Hidden console window execution with hidcon or PowerShell hidden mode
  • Base64 decoding of payloads and code decryption
  • Geoblocking to restrict payload downloads by region
  • Outlook VBA modules for spearphishing attachments
  • Disguising malicious ZIP archives as Office documents
  • Registry tampering to disable macro warnings and hide folders/files
  • CreateProcess and rundll32 usage for component creation
  • CSharpCodeProvider based downloader compilation on the infected system
  • Self‑extracting 7z archives delivered within attachments
  • Obfuscated .drv files and System.Reflection.Assembly PowerShell scripts for data exfiltration
  • LNK file abuse to hide malicious scripts and replicate via User Assist registry key
  • Scheduled task creation for delayed execution
  • UltraVNC and other VNC tools for remote control
  • Minute‑by‑minute screenshots of the compromised system
  • PowerShell scripts for security‑software detection
  • Detection of removable drives before sending documents

MITRE ATT&CK Tactics

Command and Control
Execution
Persistence
Defense Evasion
Exfiltration
Discovery
Collection

ATT&CK Techniques

T1071.001
T1570
T1059.005
T1027
T1547.001
T1041
T1070.008
T1566.001
T1036
T1112
T1106
T1059.001
T1045
T1053.005
T1113
T1018
T1064
T1583
T1059.007
T1561
T1025
T1547
T1564
T1137
T1119
T1120
T1071
T1106
T1005
T1140
T1036
T1055
T1620
T1112
T1491
T1505.003
T1059
T1020
T1070
T1083
T1568
T1480
T1057
T1041
T1534
T1566
T1559
T1001
T1039
T1571
T1027
T1486
T1685
T1095
T1588
T1105
T1587

Software / Tooling

PowerShell
VBScript
Batch scripts
hidcon
Microsoft Outlook VBA projects
MS Office InteropObject
mshta.exe
regedit
UltraVNC
Process Explorer
rundll32
Microsoft.CSharp.CSharpCodeProvider

Campaigns & Victims

Since its first observed activity in early March 2026, Doommageddon has executed a series of campaigns across more than thirty countries targeting critical sectors such as healthcare, finance, transportation, and energy. The actor frequently employs spearphishing with malicious Office templates to establish initial footholds, then expands lateral movement through file‑system scanning and data exfiltration over fast‑flux HTTP/HTTPS channels. Their notable operations—spanning from hospital attacks in the United States to manufacturing facilities in Turkey—reflect an opportunistic yet systematic approach that balances stealth (e.g., registry tampering, hidden execution) with aggressive extortion tactics. Operational tempo appears relatively steady, with incidents reported every few weeks, indicating sustained resource investment.

IOC Patterns

  • Repeated usage of the same TLS certificate across infrastructure
  • Base64‑encoded source code for downloader payloads
  • Fast‑flux DNS with rotating IP addresses
  • Geo‑blocking restrictions on download by location
  • Hidden console window execution patterns
  • Run keys entries in registry for persistence
  • Deletion of victim files/folders during cleanup
  • Registry key modifications to Office VBA security settings (HKCU\Software\Microsoft\Office\\Security\VBAWarnings, AccessVBOM)
  • HKEY_CURRENT_USER\Console\WindowsUpdate used for C2 addresses
  • Malicious LNK shortcuts on network and removable drives
  • Obfuscated .drv files
  • Compressed archives disguising malicious content (ZIP disguised as Office docs)

Recommended Actions

  • Block or sandbox execution of obfuscated PowerShell scripts containing Base64 encoded payloads.
  • Deploy endpoint detection to alert on batch and VBScript file execution events.
  • Enforce monitoring of Run key registry persistence entries for unauthorized modifications.
  • Implement fast‑flux DNS detection and block connections to known malicious C2 domains.
  • "TLS inspection" to identify anomalous certificate reuse across infrastructure.
  • Block or monitor malicious Office macros in Word/Excel and Outlook VBA projects; enable macro warnings via Group Policy.
  • Detect and log file deletion or cleanup behaviors associated with T1070.008.
  • Monitor registry changes affecting VBA security settings and HKEY_CURRENT_USER\Console\WindowsUpdate for C2 addresses.
  • Detect anomalous usage of mshta.exe, rundll32, and other legitimate executables with suspicious arguments.
  • Block or monitor creation of LNK shortcuts on shared storage and removable media devices.
  • Deploy application control to detect execution of Process Explorer and similar discovery tools.
  • Set alerts for scheduled task creation and minute‑by‑minute screenshot capture activity.
  • Apply network segmentation and restrict unauthorized VNC traffic; block or monitor UltraVNC connections.
  • Educate users on spearphishing with malicious attachments and suspicious links.

Suggested Tags

gamaredon
ransomware
double-extortion
direct-extortion
macro‑based attack
powershell
vbscript
batch scripts
c2 over http/https
fast-flux dns
obfuscated scripts
run key persistence
data exfiltration
cloud hosting
vps
telegram
spearphishing attachment
registry tampering
remote control
ultravnc
obfuscated driver
self‑extracting archive
lnk shortcut abuse
removable media exfiltration

Confidence Assessment

The available data provides a coherent view of Doommageddon’s threat profile, drawing from multiple independent indicators and known campaign patterns. While the synthesis resolves many overlaps, some ambiguities remain—particularly regarding precise attribution across all campaigns and the extent of the actor’s infrastructure. Additional evidence such as validated attribution artifacts or confirmed command‑and‑control domains would further solidify confidence.

Threat Intelligence Report

No report generated yet.

ATT&CK Techniques

Software / Tooling

Campaigns / Victims

Observed Data

No observed data linked yet.

Indicators of Compromise

SHA-256 Hash 1 Filename 2 SHA-1 Hash 1 Domain 13 Email Address 1 IPv4 Address 2

References

  1. www.ransomware.live — Cited by web research for: Bjorka
  2. attack.mitre.org — Cited by web research for: T1566
  3. mallory.ai — Cited by web research for: T1486
  4. redpiranha.net — Cited by web research for: T1059.007
  5. cti.cyberdudebivash.in — Cited by web research for: CVE-2026-42533
  6. www.malwarepatrol.net — Cited by web research for: Aerospace
  7. https://cisa.gov — Cited by AI analysis.
  8. http://derp.ca — Cited by AI analysis.
  9. https://hunt.io — Cited by AI analysis.
  10. https://ransomwhere.org — Cited by AI analysis.
  11. https://logo.dev — Cited by AI analysis.
  12. https://backdoor.mistic.com — Cited by AI analysis.
  13. https://adpo.com — Cited by AI analysis.
  14. http://cmdofficial.com — Cited by AI analysis.

Intel Summary

52

Techniques

58

Tools

102

Campaigns

39

IOCs

0

Observed Data

13

Tactics

Tags

Ransomware
Financial-gain
Double extortion
Sectors: healthcare, automotive, chemical, real estate, finance
gamaredon
ransomware
double-extortion
direct-extortion
macro‑based attack
powershell
vbscript
batch scripts
c2 over http/https
fast-flux dns
obfuscated scripts
run key persistence
data exfiltration
cloud hosting
vps
telegram
spearphishing attachment
registry tampering
remote control
ultravnc
obfuscated driver
self‑extracting archive
lnk shortcut abuse
removable media exfiltration

Details

Type
Criminal
Sophistication
Medium
Primary Motivation
Organizational gain
Country of Origin
Russia (RU)
Confidence
80%
First Seen
Mar 8, 2026
Last Seen
Jul 19, 2026
Added
Jul 13, 2026
No notes yet. Click "Add Note" to create the first analysis note.
No opinions yet. Be the first to assess this intelligence.
Leaving Threaticon

This link opens an external site that isn't part of the platform.