{
	"id": "5e0830ac-671f-4dbc-bb23-db031685ca1a",
	"created_at": "2026-04-06T00:12:25.722705Z",
	"updated_at": "2026-04-10T03:21:00.653995Z",
	"deleted_at": null,
	"sha1_hash": "1d4b59706135b329c427a1a1535d02aeb5618e24",
	"title": "Ransomware gang says it breached one of NASA's IT contractors",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 302803,
	"plain_text": "Ransomware gang says it breached one of NASA's IT contractors\r\nBy Written by Catalin Cimpanu, ContributorContributor June 2, 2020 at 5:29 p.m. PT\r\nArchived: 2026-04-05 13:06:49 UTC\r\nImage: ZDNet\r\nThe operators of the DopplePaymer ransomware have congratulated SpaceX and NASA for their first human-operated rocket launch and then immediately announced that they infected the network of one of NASA's IT\r\ncontractors.\r\nIn a blog post published today, the DopplePaymer ransomware gang said it successfully breached the network of\r\nDigital Management Inc. (DMI), a Maryland-based company that provides managed IT and cyber-security\r\nservices on demand.\r\nAccording to the company's press releases, DMI's customer list includes several Fortune 100 companies and many\r\ngovernment agencies, among them NASA [1, 2].\r\nIt is unclear how deep inside DMI's network the DopplePaymer gang made it during their breach, and how many\r\ncustomer networks they managed to breach. Three DMI spokespersons did not answer phone calls from ZDNet\r\nseeking comment for this article.\r\nThe thing that appears to be clear is that they got their hands on NASA-related files, suggesting they breached\r\nDMI's NASA-related infrastructure.\r\nhttps://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/\r\nPage 1 of 2\n\nTo support their claims, the DopplePaymer operators posted 20 archive files on a dark web portal the group is\r\noperating.\r\ndmi-nasa.png\r\nImage: ZDNet\r\nThe archives include everything from HR documents to project plans, as can be seen from a screenshot ZDNet\r\ntook of one of the files. Employee details included in these files matched public LinkedIn records.\r\ndmi-forms-wfh.png\r\nImage: ZDNet\r\nFurthermore, the DopplePaymer gang also posted a list of 2,583 servers and workstations that hackers claim are\r\npart of DMI's internal network, and which they have encrypted and are now holding for ransom.\r\ndmi-machine-list.png\r\nImage: ZDNet\r\nThe purpose of releasing all these files is for extortion. The DopplePaymer ransomware crew is one of several\r\nransomware gangs that operate \"leak sites\" where they publish data from hacked companies.\r\nDopplePaymer operators first share small samples like the one they shared today, and in case the victim isn't\r\nintimidated and still refuses to pay the file decryption fee, they leak all files as revenge.\r\nSuch extortion tactics have been employed since December 2019, and today, they also saw a major change when\r\nthe operators of the REvil (Sodinokibi) ransomware gang added a kink in this tactic by launching an eBay-like\r\nauction site where they're selling the stolen victim data instead of giving it away for free.\r\nSecurity\r\nEditorial standards\r\nSource: https://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/\r\nhttps://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA",
		"Malpedia"
	],
	"references": [
		"https://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/"
	],
	"report_names": [
		"ransomware-gang-says-it-breached-one-of-nasas-it-contractors"
	],
	"threat_actors": [],
	"ts_created_at": 1775434345,
	"ts_updated_at": 1775791260,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/1d4b59706135b329c427a1a1535d02aeb5618e24.pdf",
		"text": "https://archive.orkl.eu/1d4b59706135b329c427a1a1535d02aeb5618e24.txt",
		"img": "https://archive.orkl.eu/1d4b59706135b329c427a1a1535d02aeb5618e24.jpg"
	}
}