By Rebecca Harpur|Last Updated: October 14th, 2024|2 min read|Categories: Dark Web, Data Exfiltration, Ransomware|

Contents

The group behind Doubleface ransomware has recently attacked the website of Donetsk International Airport, demonstrating its capability to execute high-profile cyberattacks.

Key Features and Pricing

Doubleface ransomware uses the C/C++ programming language. It also employs AES-128 and RSA-4096 encryption algorithms.

According to the seller, Doubleface ransomware is undetected by most major antivirus programs like Windows 10/11 Defender, Avast, Kaspersky and AVG. Its unpredictable behavior lets it bypass existing cybersecurity defenses.

Unlike some ransomware variants, Doubleface does not require a stub. But attackers must be careful in the management of the decryption key, because the wrong key will destroy all encrypted files.

The ransomware can work independently of an internet connection or network. It supports evasion of virtual machines, debugging tools and sandbox environments. These stealth features make it difficult to detect and mitigate.

This ransomware costs USD 500 per copy and can be bought in bulk. Also available for USD 10,000 is the complete source code for the ransomware. That opens up the code for cybercriminals to take it and perhaps modify it for their own purposes/purposes.

Notable Incidents

The group behind Doubleface ransomware is said to have attacked the website of Donetsk International Airport on August 10, 2024. This suggests that they might be involved in important or politically driven attacks.

Image: Doubleface posting their airport takedown on a messaging application

Secure Your Organization With BlackFog

The recent attack by the Doubleface ransomware at Donetsk Airport shows that we need stronger protection for important systems. Ransomware locks files, stopping people from using them until the attackers get paid. But paying them only makes them attack more.

BlackFog’s ADX solution prevents cyberattacks including ransomware and crucially stops data exfiltration attempts in real-time. It constantly watches network activity and quickly stops any unauthorized copying or stealing of data as it happens, 24/7, without the need for human interaction. This stops files from being locked in the first place.

Click here to learn more about how BlackFog can protect your business.