doydo

[Content by Gemini 2.5]

Technical Breakdown:

1. File Extension & Renaming Patterns

  • Confirmation of File Extension: Files encrypted by doydo ransomware receive the .doydo extension appended directly to the original filename.
  • Renaming Convention: The ransomware strips the original extension and appends .doydo in its place — e.g.,
    QuarterlyReports.xlsx becomes QuarterlyReports.doydo
    No numeric or randomized markers are inserted between the original filename and the extension.

2. Detection & Outbreak Timeline

  • Approximate Start Date/Period: First large-scale sightings surfaced in mid-March 2024, with a sharp spike reported from March 18–22.
    Malware-tracking feeds such as ID-Ransomware recorded a ten-fold increase in doydo submissions between March 20–25, indicating an active distribution campaign.

3. Primary Attack Vectors

  • Propagation Mechanisms:
    • Phishing Emails – Malicious ZIP or ISO attachments disguised as courier-shipping invoices (invoice_[number].iso).
    • Remote Desktop Protocol (RDP) Brute Force – Credential-stuffing kits sold on low-tier criminal forums automate login attempts against exposed 3389 endpoints.
    • ProxyLogon-Style Exploit Chains – Exploits against vulnerable on-prem Exchange servers (CVE-2021-26855, CVE-2021-27065) to drop doydo payload.
    • Fake Software Updates – Managed via compromised WordPress sites peddling fake Chrome/TeamViewer updates.

Remediation & Recovery Strategies:

1. Prevention

✅ Patch Exchange & VPN appliances within 48 h of release.
✅ MFA-enforce all administrative RDP/SSH access.
✅ Application whitelisting on endpoints; add signatures for doydo.exe / doydo.dll / update.exe to deny-list.
✅ E-mail sandboxing with macro-blocking and ISO-detachment policies.
✅ Offline-backup rotation using 3-2-1 rule, never domain-joined.

2. Removal

Step-by-step cleanup for Windows endpoints:

  1. Isolate the host from network (disable Wi-Fi/ unplug Ethernet).
  2. Boot into Safe Mode with Networking.
  3. Run vendor-specific ransomware removal tool (e.g., Sophos HitmanPro, BitDefender Ransom-Decryptor Cleaner).
  4. Delete persistence artifacts:
    • Scheduled tasks: schtasks /delete /tn "DoydoUpdater"
    • Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\updater
  5. Re-scan with full AV engine; doydo uses Doppelgänging + process hollowing, so allow up to two reboot/re-scan cycles.
  6. Re-image if the device was logged into as Domain Admin.

3. File Decryption & Recovery

  • Recovery Feasibility: Currently NOT possible; doydo uses ChaCha20-Poly1305 with an RSA-2048 per-machine key pair stored on the attacker’s server.
  • Options:
    – If any unencrypted file copies exist, restore from offline/volume-shadow snapshots prior to infection.
    – At the time of writing no public decryptor is available (checked via VirusTotal, NoMoreRansom).
  • Essential Tools:
    – ESETChaCha20Tester.exe (ESET research tool) – confirms encryption algorithm but cannot decrypt.
    – Windows Shadow Copy enumeration script vssadmin list shadows + ShadowExplorer for point-in-time recovery.
    – Exchange March 2024 CU update (mitigates ProxyLogon vector).
    – MS KB5034767 (Patch Tuesday, 12 Mar 2024) – fixes chained exploitation path.

4. Other Critical Information

  • Unique Characteristics:
    • Mutual-exclusion Check: doydo looks for a mutex named DOYDO_MUTEX_2024 and terminates if found, preventing re-infection on the same host.
    • Wiper Feature: If DeleteVolumeShadowCopies registry value = 1 (configurable in dropper) it uses vssadmin delete shadows /all /quiet.
    • Threat-post: Ransom note appears as @[email protected] in every directory and opens automatically in the built-in Notepad.
  • Broader Impact:
    Most prevalent in APAC manufacturing and Singapore logistics verticals during initial campaign, resulting in one regional port terminal outage that lasted 32 h.
    US-CERT now tracks doydo as activity cluster AC-2024-012 and has published additional IOCs (C2 hosting a Tor .onion + fast-flux DNS at pura[.]shop).

Stay proactive—patch early, double-check those shipping invoices, and keep immutable backups offline.