This entry covers two related Windows ransomware families. BitPaymer appends .locked to encrypted files and leaves a note for each file ending in .readme_txt. DoppelPaymer, a 2019 fork built on much of the BitPaymer code, uses .doppeled and a note named .how2decrypt.txt. DoppelPaymer struck hospitals, emergency dispatch, colleges and local government on Windows workstations and servers. Its operators stole data first, then used leak threats and phone calls to push payment. BitPaymer is linked to the crew behind the Dridex banking trojan. DoppelPaymer has posted no victims since April 2021.
File extensions: locked, .readme_txt
Decryptor: Decryptor availability has not been recorded.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161