DoppelPaymer ransomware

DoppelPaymer is a human-operated ransomware family first seen in June 2019 that grew out of BitPaymer. Early builds add .locked to encrypted files and write a separate note for every file, named after it with .readme2unlock.txt appended. The note says every host on the network has been encrypted and backups wiped, and sends the victim to a Tor payment portal with a seven-day window; a later version used the .doppeled extension. The operators hit Windows networks in healthcare, emergency services, education and local government, sometimes after an initial Dridex infection, and demanded six- and seven-figure sums. They copied data out before encrypting and followed up with phone calls threatening to leak or sell it.

File extensions: .doppeled

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-26.

Data exfiltration risk: Confirmed — An FBI Private Industry Notification states the actors exfiltrated data before encryption and used it in extortion, including phoned threats to leak or sell it.

Systems typically targeted: Windows workstations and servers on corporate and public-sector networks

Do this first: Do not reset, rename or move encrypted files and their per-file notes, isolate affected hosts and report the incident to the FBI before deciding on recovery.