Day 6: DoppelPaymer/Grief Ransomware

Both DoppelPaymer and Grief infiltrate the networks using malicious spam emails with spear-phishing links or attachments luring unsuspecting users to execute the malicious code disguised as a legitimate document. The code downloads other malware including Emotet with advanced capabilities into the victim’s system. Emotet will communicate with its command-and-control (C&C) server installing various modules and downloading and executing other malware. The C&C server downloads and executes the Dridex malware to move within the affected system’s network finding high-value targets to steal critical information. Once it finds a target, Dridex will deploy the DoppelPaymer ransomware encrypting files in the network as well as fixed and removable drives in the affected system. DoppelPaymer will change the user’s password before forcing the system to restart into safe mode preventing user entry from the system and changing the notice text that appears before Windows proceeds to the login screen.