Ransomware landscape constantly changes, which can make it difficult to track which attackers are coming, going or simply rebranding. One expert says the operation appears to have been rebranded by its operator, Evil Corp, in an attempt to avoid sanctions imposed on the crime group in December 2019 by the U.S. Treasury Departments Office of Foreign Assets Control. The fallout from numerous attacks appear to have led at least some ransomware operations to stand down, at least temporarily, or alter their approach. One change from the DoppelPaymer days is that while the group previously demanded payment in bitcoins, Grief wants victims to pay in monero.”]
Source: https://www.careersinfosecurity.com/ransomware-changes-doppelpaymer-rebrands-babuk-evolves-a-17185