Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 13:26:06 UTC
Home > List all groups > List all tools > List all groups using tool Grief
 Tool: Grief
Names
Grief
Pay or Grief
Category Malware
Type Ransomware, Big Game Hunting
Description
(Zscaler) An early Grief ransomware (aka Pay or Grief) sample was compiled on May 17,
2021. This sample is particularly interesting because it contains the Grief ransomware code
and ransom note, but the link in the ransom note points to the DoppelPaymer ransom portal.
This suggests that the malware author may have still been in the process of developing the
Grief ransom portal. Ransomware threat groups often rebrand the name of the malware as a
diversion.
Information
Last change to this tool card: 26 December 2021
Download this tool card in JSON format
All groups using tool Grief
Changed Name Country Observed
APT groups
 Doppel Spider 2019-May 2025
1 group listed (1 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=aa2dfc3d-ed20-4970-9624-ea19b096a395
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=aa2dfc3d-ed20-4970-9624-ea19b096a395
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=aa2dfc3d-ed20-4970-9624-ea19b096a395
Page 2 of 2

APT groups Doppel Spider 2019-May 2025 
1 group listed (1 APT, 0 other, 0 unknown) 
   Page 1 of 2