Grief
Grief is a Russia-attributed ransomware group with a financial motive, tracked by Brandefense. It targets 3 sectors, including Government and Manufacturing, in 16 countries, including the United States and the United Kingdom.
Also known as
- Doppel Spider
- Gold Heron
- Grief Group
- Origin
- Russia
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2019
- Record updated
Who They Target.
Countries · 16
Labelsransomware
About Grief.
Doppelpaymer is a ransomware family that encrypts user data and later on it asks for a ransom in order to restore original files. It is recognizable by its trademark file extension added to encrypted files:.doppeled. It also creates a note file named: ".how2decrypt.txt".
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.