Doommageddon — Ransomware Profile
Doommageddon is a recently surfaced crypto-ransomware operation that emerged in mid-2026, known primarily from a Tor data-leak site (its earliest publicly listed victims date to May 2026, and public trackers catalogued the group in early July 2026). It runs a double-extortion model — encrypting victim files with an RSA-2048 scheme, appending the .doomag extension and dropping a README_DECRYPT.txt ransom note, while threatening to publish stolen data on its leak site — and negotiates with victims over the Session messenger. Its first wave of five publicly listed victims spans manufacturing, automotive, technology, real estate and financial services across Turkey, India, Brazil and Paraguay, with no clear sectoral or geographic focus. No vendor or CERT has yet published tradecraft analysis, exploited-vulnerability data, or any link tying Doommageddon to a prior ransomware brand; it remains a low-visibility, newly emerged operation.
IntelFusions coverage (3)
Tools & malware
- Session (messenger) Communication
Recent claimed victims
Vendor research
Read the full analysis on IntelFusions