Tracking Doommageddon’s Ransomware Campaign

Doommageddon is a financially motivated ransomware operation built around the now-familiar double-extortion model: steal data first, encrypt systems second, then threaten publication if the victim doesn’t pay. What makes the group interesting is how long it was able to operate in the shadows. Cynet’s analysis traced the group’s earliest known intrusion to March 8, 2026.