Doommageddon is a Windows ransomware family that appends .doomag to encrypted files and drops a plain-text instruction file. The note claims RSA-2048 protection, tells the victim to reach the operators through the Session messenger using a supplied ID, and warns that recovery utilities will destroy the data. The group appeared in spring 2026 and runs a Tor leak site where it posts organisational victims, so data theft should be assumed even though the note itself is silent on it. No link to an earlier family has been established.
File extensions: .doomag
Ransom note filenames: README_DECRYPT.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161