WastedLocker ransomware: what it is and how to remove it
WastedLocker ransomware is a threat that is known for its ability to attack businesses, organizations, websites, lock all the files located on the local and networked drives, and then demand ransom between $500,000 and $10 million.
The malware was developed and is distributed by a cybercriminal group known as the Evil Corp/Indrik Spider - hackers who are responsible for such prominent threats as Dridex banking trojan and BitPaymer ransomware, although, the virus has no associations with previous gang's creation and operates quite a bit different.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Make sure nothing will rename more files to .d2lwasted: an automatic scan checks the PC first.
Do it yourself · free Remove WastedLocker ransomware yourself 6 steps, about 18 minutes, no software needed.
Start the steps
WastedLocker ransomware: summary
| Distribution | Fake update prompts and other sophisticated methods |
|---|---|
| Name | WastedLocker |
| Type | Ransomware, file locker |
| Developers | Evil Corp (Indrik Spider) – an established cybercriminal gang that is believed to be Russian |
| Release date | May 2020 |
| Targets | Malware targets mainly US organizations, with a few exceptions (some attacks were also seen in Europe) |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 14 more facts
| Ransom size | $500,000 – $10 million, sometimes even more |
|---|---|
| File extension | "wasted" which is accommodated by the version name at the front, e.g., .d2lwasted |
| Detection names | No Microsoft detection name is known |
| Contact | Not recorded in our earlier report |
| Encrypted file extension | .d2lwasted |
| Decryptor | No free decryptor is known for this variant; check No More Ransom (nomoreransom.org) for updates |
| Ransom note | A message left on the computer; another interesting trait of this ransomware is that it also creates a ransom note for each of the encrypted files, e; the text is quoted in full below |
| Damage | Not recorded in the old report |
| Symptoms | Files renamed with a new extension and a ransom note left in folders |
| Evidence | 5 write-ups by security sites; no sample analysed yet |
| Encrypted files | .d2lwasted |
| Free decryptor | No free decryptor is known (checked 7 October 2026) |
| First seen | 31 July 2020 |
| Facts checked | 7 October 2026 |
- File extension:
.d2lwasted - Note file:
the ransom note
From our report of Jul 2020 · not reviewed since
More from our earlier report on WastedLocker
- Ransomware might sometimes damage various system components, which might result in PC crashes and similar issues after malware elimination.
- Free up some memory urgently, your computer is overloaded!
How WastedLocker ransomware behaves
From our report of Jul 2020 · not reviewed since
WastedLocker ransomware - a customized malware developed and distributed by BitPaymer gang
WastedLocker ransomware is a threat that is known for its ability to attack businesses, organizations, websites, lock all the files located on the local and networked drives, and then demand ransom between $500,000 and $10 million.
The malware was developed and is distributed by a cybercriminal group known as the Evil Corp/Indrik Spider - hackers who are responsible for such prominent threats as Dridex banking trojan and BitPaymer ransomware, although, the virus has no associations with previous gang's creation and operates quite a bit different. WastedLocker virus recently encrypted files of a tech giant Garmin, which interrupted the services the company ran for several days.
WastedLocker uses a combination of AES and RSA encryption algorithms in order to encrypt files on networks and servers. However, the way the virus applies an extension is quite a bit different - it uses an abbreviation of the company's name and the word "wasted.
For example, the variant "d2l" would append the ".d2lwasted" extension to all vulnerable files (document, database, audio, video, and others). Another interesting trait of this ransomware is that it also creates a ransom note for each of the encrypted files, e.g., "picture.d2lwasted_info."
WastedLocker ransomware can be spread via several different ways, although researchers spotted the booby-trapped websites that attempt to begin the attack. In most cases, the fake notifications show up in a way that they look legitimate as they mimic original software looks.
An example of such fake notification as follows:
Once the company member clicks on a fake update prompt, the attackers manage to gain access to the company's networks thanks to the exploit kit that is used. Once malicious actors behind WastedLocker ransomware gain access to the network, they deploy the ransomware payload.
WastedLocker takes a different approach than most ransomware when it comes to the selection of which data is to be encrypted. Most malware of such type use a predetermined list of file extension for the purpose, and this malware strain rather uses a list of directories where the data is to be encrypted. Nonetheless, the virus has a list of file extensions that are not to be encrypted as well.
The extension applied to files once encryption is complete uses a combination of the company's name + the word "wasted." There have been many attacks on various companies (including the most notorious one against Garmin), so file extensions varied as follows:
- .bbawasted
- .d2lwasted
- .eswasted
- .rlhwasted
- .garminwasted
- others
The ransom note explains the following:
Luckily for those who had backups available, there is no need to pay the ransom, as malicious actors do not leak sensitive data in order to post it publicly as many other ransomware gangs, such as Maze, DoppelPaymer, Clop, Nefilim, and others.
Thus, the infected users should disconnect each of the machines from the network and then remove WastedLocker ransomware. If a need arises, Safe Mode with Networking can be used for the purpose.
- Attempts to disable Windows Defender, Symantec, and other implemented protection suites;
- Deletes Shadow Volume Copies and other automated Windows backups;
- Acquires elevated permissions that grants access to manage directories;
- Modifies Windows registry files;
- Creates several processes and runs its own service, etc.
The WastedLocker ransomware note
BBA Aviation
YOUR NETWORK IS ENCRYPTED NOW
USE - | - TO GET THE PRICE FOR YOUR DATA
DO NOT GIVE THIS EMAIL TO 3RD PARTIES
DO NOT RENAME OR MOVE THE FILE
THE FILE IS ENCRYPTED WITH THE FOLLOWING KEY:
KEEP IT
How to remove WastedLocker ransomware
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove WastedLocker and get your files back
Work in this order.
Disconnecting comes first, removal comes before any restore, and nothing here asks you to contact the attackers.
Step 1: Disconnect the PC and unplug backup drives
Unplug the network cable or turn off Wi-Fi, and disconnect USB drives, external disks and network shares, so WastedLocker cannot reach more files. Pause OneDrive, Google Drive or Dropbox sync, because synced folders upload the encrypted copies over the good ones.
Leave the PC on but offline while you read the next steps, since a restart can let the ransomware run again. This applies to Windows 11 and Windows 10 alike.
Windows 11: turn off Wi-Fi to take the PC offline. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 2: Save the ransom note and confirm the family
Your files now end in
.d2lwastedand the instructions are inthe ransom note. Save both to a USB stick, a copy of the note and two small encrypted files, before anything else.On another device, check them with ID Ransomware or Crypto Sheriff: the family name decides which decryptor, if any, can help. Keep the note's ID and contact line for your report.
Windows 11: the ransom note and encrypted files to copy for identification. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 3: Check for a free decryptor
Our last check found that for WastedLocker, no free decryptor is known (checked 7 October 2026). Look again yourself in the No More Ransom list and the free decryptor pages of Emsisoft, Avast and Kaspersky, which add new families every year.
A decryptor needs the ransomware gone first, or it encrypts the files again. Keep at least one copy of the encrypted files on an external drive, even if no tool works yet.
Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 4: Remove the ransomware before you restore or decrypt
Removing WastedLocker does not bring the files back, but it has to come first. Start with Defender's Full scan, then the offline scan from the same Scan options page, which checks the disk before Windows loads.
If the scan cannot start, use Safe Mode with Networking. Delete the ransom notes only after you have saved a copy, because removal tools sometimes leave them behind on Windows 11 and Windows 10.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Look for shadow copies of the files
Windows keeps shadow copies for restore points and backups, and some ransomware fails to delete them.
vssadmin list shadowsin an administrator Command Prompt tells you at once whether any exist.If they do, right-click the folder that held your files, open Properties > Previous Versions, select a version from before the attack, and click Open to check it before you Restore or copy the files out. Windows 11 and Windows 10 both have the tab.
Windows 11: vssadmin list shadows shows whether shadow copies exist. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 6: Restore the files from a backup or recover deleted originals
A backup made before the attack is the surest way back. Connect it only once the PC is clean, then restore from File History, Windows Backup, OneDrive's Restore your OneDrive or your own external copies.
Without a backup, try file recovery: the originals that WastedLocker deleted may still be on the disk until something overwrites them. Install nothing new on the drive you want to recover from on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Recover deleted files (Recycle Bin, backups, OneDrive) On uGetFix
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
From our report of Jul 2020 · not reviewed since
WastedLocker file recovery options
Ransomware has been on the for several years now, as the business is very lucrative, and even North Korean state-backed hackers are keen on cashing on it.
Therefore, new strains are being released regularly, and companies should keep in mind that they are in great danger.
To prevent maximum damage caused by WastedLocker, backups are needed. However, backups need to be stored on a separate medium that should not be connected to the main server/network. This way, negating the infection can become much easier, as paying the ransom becomes obsolete.
However, if WastedLocker ransomware encrypted your backups, recovery can be very difficult, if not impossible, without paying the ransom. There are several methods that could work, in some cases:
As evident, WastedLocker developers ask for very high ransom payments, and there is no guarantee that the crooks will provide service that they promised.
- Third-party recovery tools that sometimes could retrieve at least some files;
- Built-in Windows defenses could sometimes be preserved if malware failed to perform its core functions;
- Data decryption software that could be designed by security researchers in the future.
From our report of Jul 2020 · not reviewed since
WastedLocker removal instructions
To remove WastedLocker ransomware, a powerful anti-malware solution should be used.
However, in case of backups are not available for you, you should first copy all the encrypted files to a separate hard drive or another medium, as they might be useful in the future.
Before WastedLocker ransomware removal can be executed, each of the machines should be disconnected from the network so that the infection would not reoccur. Then, you should perform a full system scan with powerful anti-malware software that would be able to eliminate all the malicious files and restore Windows to its pre-infection stage.
Finally, if you do not have backups available after the WastedLocker virus attack, you should attempt to retrieve them by following the instructions we provide below.
[GI=method-1]In case of malware is tampering with your security software, follow these steps to gain access to Safe Mode with Networking:
Unfortunately, it rarely works for ransomware victims.
Windows Previous Versions Feature could be useful
If you had System Restore enabled and it was not eliminated during ransomware infection routine, you could attempt to recover encrypted files one-by-one.
Make use of ShadowExplorer
ShadowExplorer would help if the virus failed to delete Shadow Volume Copies on the system.
No decryption tool is currently available
Report it and recover your files
Report it
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
Protect the files you restore
Restore only after the scans are clean and the PC no longer shows files that end in .d2lwasted and no longer open; otherwise the restored copies can be damaged again.
Then build a backup that survives the next infection:
- one copy in the cloud with version history
- one on an external drive that is disconnected between backups
- the working copy on the PC
Version history matters because a backup that syncs damaged files overwrites the good ones.
How to do this with the tools built into Windows: the 3-2-1 backup rule on Windows.
Protect your privacy - employ a VPN
There are several ways how to make your online time more private - you can access an incognito tab.
However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise.
Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers - human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence.
In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. is one of the leading file recovery solutions you can find on the market - it is likely to restore even lost emails or data located on an external device.
Questions about WastedLocker ransomware
Is there a decryptor for .d2lwasted files?
That depends on the family behind the .d2lwasted extension, which this guide cannot confirm yet from the reports alone. Check No More Ransom and ID Ransomware with your ransom note and one encrypted file; they list families with free tools.
If none exists today, keep the encrypted files and a copy of the note on a separate drive, because decryptors are sometimes published months later after flaws are found or servers are seized. Never buy a decryptor from a website that is not the security company that made it.
How do I open .d2lwasted files?
You cannot open them by renaming or by choosing another program. The .d2lwasted ending shows that WastedLocker encrypted the content, and only the matching key can reverse it. Renaming a file back to .docx or .jpg changes nothing except the icon, and it can confuse a future decryptor, so leave the names as they are.
To get the content back, use a backup, an unencrypted copy elsewhere, or a decryptor listed on No More Ransom if one exists for WastedLocker. Store the encrypted files on an external disk until then.
Should I pay the ransom?
We advise against it, and so do the FBI, Europol and national cyber agencies. Payment does not guarantee a working tool: some attackers never reply, some tools damage files, and some variants have no decryptor at all. Paying also funds further attacks and can make you a target again.
Before considering payment, try every recovery option in this guide and report the attack. Companies must involve their legal adviser and insurer, because payments to sanctioned groups can be illegal. If files are truly irreplaceable, store the encrypted copies and wait; decryptors sometimes appear later.
Are ransomware recovery services legitimate?
Some are, but read the offer carefully. Genuine data-recovery firms recover deleted originals from disks or rebuild damaged files, and they say so. Others promise to "decrypt any ransomware" for a fixed price, which is impossible without the key; they quietly pay the attackers and keep a margin, sometimes without telling the victim.
Be especially careful with services that contact you after you post about the attack online. Ask for references, a written method and a no-result-no-fee clause, and check the free tools on No More Ransom first.
How did WastedLocker get on my computer?
The way WastedLocker spreads has not been documented yet, so look at your own recent activity. On home PCs, ransomware most often comes with cracked programs, game cheats, key generators and fake updates, or with an e-mail attachment that was opened. On business networks, attackers usually log in through Remote Desktop with a stolen or guessed password.
Think back to what was downloaded or installed in the days before files that end in .d2lwasted and no longer open, and check the Downloads folder and Installed apps sorted by date. Keep anything suspicious for your report, but do not run it again.
Did WastedLocker steal my files or passwords?
We do not know yet. Nothing published so far shows data theft by WastedLocker, but the only confirmed sign is files that end in .d2lwasted and no longer open, which says nothing about what happened before. Many current ransomware attacks copy files or run a password stealer first, so it is wise to act as if they did.
From a clean device, change the passwords that were saved in the browsers on this PC, starting with e-mail and banking, sign out of all sessions and turn on two-step verification. Watch bank statements and account activity for the next few weeks.
Is WastedLocker the same as other ransomware with a similar name?
Not necessarily. Ransomware names come from the file extension, the note or a word in the code, so unrelated families often end up with similar names, and one family can appear under several names. The difference matters: a decryptor or advice for one family does not fit another and can damage files.
Compare the ending added to your files and the exact name of the note with the summary table at the top of this guide, then upload the note and one encrypted file to ID Ransomware from a clean device. If the result names another family, follow the guide for that family instead.
Can I delete the ransom note?
Yes, the note itself is harmless text and deleting it does not affect your files. Keep at least one copy first, outside the infected PC. the ransom note contains your personal ID and the attackers' contact details, which identification services use to tell which family encrypted your files, and which a decryptor may need later.
Police reports also ask for it. Once you have saved a copy, you can remove the notes from every folder after the ransomware program has been removed and your files are restored or backed up.
Should I reinstall Windows after the .d2lwasted attack?
Reinstalling removes the ransomware but not the encryption: your files ending in .d2lwasted stay encrypted afterwards. So first copy the encrypted files and the ransom note to a separate drive, in case a decryptor appears later. Then decide:
- a clean-up with an offline scan is often enough for home PCs
- while a full reset is safer if remote access was involved
- scans keep finding new items
Restore your backups only after the PC is clean, and change passwords from another device.
Will Fortect remove WastedLocker?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For WastedLocker, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Crowdstrike: Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware (read October 7, 2026)
- Malwarebytes Labs: Threat spotlight: WastedLocker, customized ransomware (read October 7, 2026)
- ZDNet: Here's a list of all the ransomware gangs who will steal and leak your data if you don't pay (read October 7, 2026)
- ThreatPost: Lazarus Group Brings APT Tactics to Ransomware (read October 7, 2026)
- CISA: StopRansomware (read October 7, 2026)