← All ransomware groups

Ransomware group profile · #196 by claimed victims

Doommageddon ransomware

Direct Extortion Double Extortion

Active First seen Jul 2026 doomag

12Victims claimed on leak sites

4Victims in the last 30 days

12Victims in the last 90 days

4Countries hit

1Leak-site URLs tracked, 1 online

13 Sep 2026Latest claim recorded

Victimology

Who Doommageddon claims to have breached, from 12 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing3

Healthcare2

Other2

Technology1

Retail & E-Commerce1

Financial Services1

Transportation1

Top countries

Turkiye5

Brazil2

India2

Paraguay1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
INCOR Group	—	—	13 Sep 2026
INCOR Group incor.in	Other	IN	13 Sep 2026
SITTNAK Lojistik A.Ş. sittnak lojistik a.Ş.	Transportation	TR	28 Aug 2026
Akpera Gayrimenkul Yatırım A.Ş. akpera gayrimenkul yatırım a.Ş.	Other	TR	28 Aug 2026
iw steelTEC Makine San. ve Tic. A.Ş. iw steeltec makine san. ve tic. a.Ş.	Manufacturing	TR	26 Jul 2026
Reni Farmácias Associadas renifarmacias.com.br	Healthcare	BR	19 Jul 2026
Hospital Di Camp	Healthcare	—	10 Jul 2026
KOLORKIM KIMYA kolorkim.com.tr	Manufacturing	TR	6 Jul 2026
Mercedes-Benz Turk mercedesbenzturk.com.tr	Manufacturing	TR	6 Jul 2026
Innovano innovano.com	Technology	IN	6 Jul 2026
Francisco Imóveis franciscoimoveis.com.br	Retail & E-Commerce	BR	6 Jul 2026
Solventa & Riskmetrica \| Calificadora de Riesgos syr.com.py	Financial Services	PY	6 Jul 2026

All 12 Doommageddon victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Doommageddon is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Doommageddon ransomware still active?

Doommageddon is tracked as active. The most recent leak-site claim VULONE recorded is dated 13 September 2026. 4 victims were claimed in the last 30 days.

How many victims has Doommageddon claimed?

VULONE has recorded 12 leak-site victim claims attributed to Doommageddon since July 2026, across 4 countries and 7 sectors.

Which industries does Doommageddon target?

The sectors most often named on the Doommageddon leak site are Manufacturing, Healthcare, Other.

Which countries are most affected by Doommageddon?

Most Doommageddon victims recorded by VULONE are located in Turkiye, Brazil, India.

Where does VULONE get Doommageddon victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].