Ransomware Group intelligence
Doommageddon
ActiveTrack Doommageddon with 23 published victims and 1 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Doommageddon is tracked by Dark Eye as a ransomware group with 23 published victims.
Türkiye is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
11
- Leaked 10 90.9%
- Pending 1 9.1%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 5h ago | iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion |
Top Activity Sectors (7)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Doommageddon, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: low. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Doommageddon executes malicious payloads via PowerShell to stage ransomware components across targeted machines.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Doommageddon disables security tools like EDR and AV by terminating processes or modifying service configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: Doommageddon deletes Volume Shadow Copies and backup directories to prevent data recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
What they do: Doommageddon performs system checks to detect offline hosts or recovery mechanisms before deploying ransomware.
What that means: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
-
T1083 File and Directory Discovery Discovery
What they do: Doommageddon uses file and directory discovery to map victim systems and identify critical data for encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1560.001 Archive via Utility Collection
What they do: Doommageddon archives victim data via utility commands prior to exfiltration for extortion leverage.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1486 Data Encrypted for Impact Impact
What they do: Doommageddon encrypts victim files using strong symmetric encryption to hold data hostage for ransom.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Doommageddon inhibits system recovery by corrupting restore points and disabling backup services.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
README_DECRYPT.txt
YOUR FILES HAVE BEEN ENCRYPTED All your important files have been encrypted using RSA-2048 encryption. Attempting to decrypt files without the private key will result in permanent data loss. TO RECOVER YOUR FILES: 1. Contact us via Session app. You can download it from here, it's free and secure: https://getsession.org 2. Contact us with this ID: 05bd51745f37597905bc59249cff25569c357296ede1b0d2214215a09b6448816e 3. Provide your unique ID: [SNIP] WARNING: - Do not modify encrypted files - Do not attempt to use recovery tools. This will cause the files to be permanently destroyed. Onion Link: http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (23)
Search, filter and paginate the victim timeline for Doommageddon. Showing 1–23 of 23.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | INCOR Group id32997 View details | United States | Manufacturing / Engineering | pending | ||
|
INCOR Group is a US-based entity operating within the Manufacturing and Engineering sector, providing specialized technical and operational services relevant to industrial workflows and engineering solutions. As a ransomware victim, INCOR Group has been documented within a threat-intelligence index listing associated with the threat actor Doommageddon. This entry contextualizes the entity's sector, geographic location, and role in the cybersecurity threat landscape without disclosing unverified incident details. The listing type identifies INCOR Group specifically as a ransomware victim connected to this adversary group, supporting analysts tracking industrial-sector security events and correlated threat activity. |
||||||
| Ransomware | INCOR Group id32997 View details | United States | Manufacturing / Engineering | pending | ||
|
Status: upcoming | Data size: — | Files: 0 files | Deadline: 2026-09-20T00:00:00Z |
||||||
| Ransomware | INCOR Group id32997 View details | India | Manufacturing / Engineering | pending | ||
|
Status: upcoming | Data size: — | Files: 0 files | Deadline: 2026-09-20T00:00:00Z |
||||||
| Ransomware | SITTNAK Lojistik A.Ş. id32249 View details | Türkiye | Transportation / Travel / Logistics | leaked | ||
|
SITTNAK Lojistik A.Ş. is a Turkish enterprise operating within the Transportation, Travel, and Logistics sector, providing services related to freight movement, supply chain coordination, and related logistical solutions. The entity is cataloged in the threat-intelligence index as a ransomware victim associated with the threat actor Doommageddon. This listing reflects the observed security event linkage without disclosing unverified technical details such as data exfiltration scope, ransom demands, or confirmed breach specifics. Context is provided for cybersecurity professionals monitoring logistics-sector exposure to advanced persistent threats. SITTNAK Lojistik A.Ş. was listed as a ransomware victim associated with Doommageddon. |
||||||
| Ransomware | SITTNAK Lojistik A.Ş. id32249 View details | Türkiye | Transportation / Travel / Logistics | leaked | ||
|
Status: upcoming | Data size: — | Files: 0 files | Deadline: 2026-09-15T00:00:00Z |
||||||
| Ransomware | Akpera Gayrimenkul Yatırım A.Ş. id32250 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
Akupera Gayrimenkul Yatirim A.S. is a Turkish company operating within the manufacturing and engineering sectors, providing industrial investment and engineering-related services. The entity has been cataloged as a ransomware victim associated with the threat actor Doommageddon. This listing type indicates involvement with malicious cyber activity targeting the organization, without disclosing confirmed technical details such as data stolen, ransom demands, or breach scope. The classification supports threat-intelligence indexing for entities impacted by identified threat actors across specific geographies and industries. Contextual awareness of such incidents aids security teams in assessing risk within manufacturing and engineering supply chains. |
||||||
| Ransomware | Akpera Gayrimenkul Yatırım A.Ş. id32250 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
Status: upcoming | Data size: — | Files: 0 files | Deadline: 2026-09-15T00:00:00Z |
||||||
| Ransomware | iw steelTEC Makine San. ve Tic. A.Ş. id30861 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
iw steelTEC Makine San. ve Tic. A.Ş. is a Turkish company operating in the manufacturing and engineering sector. The company is involved in the production of steel products and machinery. It is located in Turkey, a country with a significant industrial base. iw steelTEC Makine San. ve Tic. A.Ş. was listed as a ransomware victim associated with Doommageddon |
||||||
| Ransomware | iw steelTEC Makine San. ve Tic. A.Ş. id30861 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
Status: leaked | Data size: 100 GB | Files: 0 files | Deadline: 2026-03-08T00:00:00Z |
||||||
| Ransomware | Reni Farmácias Associadas id30694 View details | Brazil | Retail / E-commerce | leaked | ||
|
Reni Farmácias Associadas is a Brazilian company operating in the retail and e-commerce sector, offering various products and services to its customers. As a retail and e-commerce business in Brazil, Reni Farmácias Associadas plays a role in the country's consumer goods market. Reni Farmácias Associadas was listed as a ransomware victim associated with Doommageddon |
||||||
| Ransomware | Reni Farmácias Associadas id30694 View details | Brazil | Retail / E-commerce | leaked | ||
|
Status: upcoming | Data size: N/A | Files: 0 files | Deadline: 2026-07-30T00:00:00Z |
||||||
| Ransomware | Hospital Di Camp id30386 View details | Italy | Healthcare / Pharma | leaked | ||
|
Hospital Di Camp is a healthcare facility located in Italy, providing medical services to patients. As a hospital, it offers a range of healthcare services, including emergency care, surgical services, and patient care. Hospital Di Camp was listed as a ransomware victim associated with Doommageddon |
||||||
| Ransomware | Hospital Di Camp id30386 View details | Italy | Healthcare / Pharma | leaked | ||
|
Status: upcoming | Data size: N/A | Files: 0 files | Deadline: 2026-07-21T00:00:00Z |
||||||
| Ransomware | KOLORKIM KIMYA id30271 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
Kolorkim.com.tr is a Turkish company operating in the manufacturing and engineering sector, providing various products and services. The company is based in Turkey and serves its customers with a range of offerings. Kolorkim.com.tr was listed as a ransomware victim associated with Doommageddon |
||||||
| Ransomware | KOLORKIM KIMYA id30271 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
Status: leaked | Data size: 1GB | Files: 1 files | Deadline: 2026-05-10T00:00:00Z |
||||||
| Ransomware | Mercedes-Benz Turk id30272 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
Mercedes Benz Turk is a Turkish company operating in the manufacturing and engineering sector, specifically in the automotive industry. The company is a subsidiary of the global Mercedes-Benz brand and offers a range of products and services in Turkey. Mercedes Benz Turk was listed as a ransomware victim associated with Doommageddon |
||||||
| Ransomware | Mercedes-Benz Turk id30272 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
Status: leaked | Data size: 50GB | Files: 1 files | Deadline: 2026-05-20T00:00:00Z |
||||||
| Ransomware | Innovano id30273 View details | India | IT | leaked | ||
|
Innovano.com is an IT company based in India, offering various services in the information technology sector. As an IT company, innovano.com provides innovative solutions to its clients. Innovano.com was listed as a ransomware victim associated with Doommageddon |
||||||
| Ransomware | Innovano id30273 View details | India | IT | leaked | ||
|
Status: leaked | Data size: 1GB | Files: 1 files | Deadline: 2026-05-30T00:00:00Z |
||||||
| Ransomware | Francisco Imóveis id30274 View details | Brazil | Construction / Real Estate | leaked | ||
|
Franciscoimoveis.com.br is a Brazilian company operating in the construction and real estate sector, providing services related to property sales and management in Brazil. The company's website is a platform for users to search and find properties. Franciscoimoveis.com.br was listed as a ransomware victim associated with Doommageddon |
||||||
| Ransomware | Francisco Imóveis id30274 View details | Brazil | Construction / Real Estate | leaked | ||
|
Status: leaked | Files: 1 files | Deadline: 2026-07-01T00:00:00Z |
||||||
| Ransomware | Solventa & Riskmetrica | Calificadora de Riesgos id30275 View details | Paraguay | Other | leaked | ||
|
Syr.com.py is a Paraguayan entity operating in the other sector, providing various offerings to its customers in the country. The entity is involved in activities specific to its sector, catering to the needs of its clients in Paraguay. Syr.com.py was listed as a ransomware victim associated with Doommageddon |
||||||
| Ransomware | Solventa & Riskmetrica | Calificadora de Riesgos id30275 View details | Paraguay | Other | leaked | ||
|
Status: upcoming | Files: 0 files | Deadline: 2026-07-08T00:00:00Z |
||||||