doommageddon
Intelligence Profile
doommageddon — tracked by MISP Galaxy (ransomware).
Intelligence Assessment
doommageddon is a financially motivated ransomware operation.
doommageddon has tracked 6 victims, all within the last 90 days, with attacks occurring between July 3, 2026, and July 10, 2026. Top sectors include Manufacturing, Consumer Services, Financial Services, Healthcare, and Technology, primarily in TR, BR, IN, and PY.
doommageddon appears to be currently active, with its last attack recorded on July 10, 2026, and all tracked victims occurring in the last 90 days, indicating ongoing operations. This suggests a high level of current risk.
Threat Analysis
doommageddon is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of financial.
Financially motivated threat actors like doommageddon prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Ransomware Victims (8)
CTIWATCH tracks 8 organizations claimed as victims by doommageddon on its data leak site, with attack dates, sectors and countries.
View full victims list →Known Campaigns
Doommageddon is conducting an active ransomware campaign targeting organizations across 4 countries. Primary targets: Consumer Services, Financial Services, Healthcare. 8 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 26 Jul 2026).