DoppelPaymer Continues to Cause Grief Through Rebranding

This report documents the emergence of Grief (aka Pay or Grief) as a rebranded variant of DoppelPaymer ransomware: the leak and ransom portals are nearly identical with cosmetic changes, the malware shares core cryptography (2048-bit RSA, 256-bit AES) and much of the same codebase with only minor modifications (e.g., removed embedded ProcessHacker binaries, RC4 key length increase), and the actors switched to Monero for payments; the report includes multiple SHA256 IOCs and detection guidance.