BitPaymer

Description

BitPaymer is a ransomware variant first observed in August 2017 targeting hospitals in the United Kingdom. It generates a unique encryption key, ransom note, and contact information for each operation, and its indicators overlap with the Dridex malware, whose crews often deliver it.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

Bitpaymer

MITRE ATT&CK techniques

18 techniques across 7 tactics.

TA0002 Execution

T1106Native API

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1070Indicator Removal
- T1070.006Timestomp
T1134Access Token Manipulation
- T1134.001Token Impersonation/Theft
T1480Execution Guardrails
T1564Hide Artifacts
- T1564.004NTFS File Attributes

TA0007 Discovery

T1007System Service Discovery
T1012Query Registry
T1018Remote System Discovery
T1087Account Discovery
- T1087.001Local Account
T1135Network Share Discovery

TA0040 Impact

T1486Data Encrypted for Impact
T1490Inhibit System Recovery

TA0112 Defense Impairment

T1112Modify Registry
T1222File and Directory Permissions Modification
- T1222.001Windows Permissions

Associated groups

G0119Indrik Spider

Alert name variants

Alert Name	Engine
DeepScan:Generic.Ransom.Bitpaymer.06BE0086	AV
Dump:Generic.Ransom.Bitpaymer.06BE0086	AV
Dump:Trojan.Ransom.BitPaymer.C	AV
Gen:Variant.Ransom.BitPaymer.2	AV
Generic.Ransom.Bitpaymer.0284916B	AV
MemScan:Trojan.Ransom.BitPaymer.C	AV
Trojan.Ransom.BitPaymer.C	AV
Win32.Ransomware.BitPaymer	ATP Sandbox Adv. Heuristics

Related families

Qilin WastedLocker InvisiMole Cobalt Strike Embargo