Loading malware…
BitPaymer, also known as FriedEx and WP_Encrypt, is a Windows ransomware family associated with the Evil Corp ecosystem and later linked to activity tracked as GOLD DRAKE and Indrik Spider. It was used in post-intrusion ransomware operations, including campaigns facilitated by Dridex and access obtained through third-party botnet operators such as TA551. BitPaymer has been tied to large-enterprise targeting and financially motivated extortion, including incidents affecting dozens of U.S. companies. It is closely related in code and tradecraft to DoppelPaymer, and overlaps in tactics with other big-game ransomware operations.
On compromised systems, BitPaymer encrypts data for impact and takes steps to hinder recovery by deleting Volume Shadow Copies. It supports persistence through Windows services and Registry-based execution mechanisms, and it interacts with the Windows Registry for both enumeration and modification. Observed behaviors include iterating through Registry keys, setting Registry values to support execution, and attempting to install itself as a service. It also performs remote system discovery using native commands to identify other reachable hosts on the network. For defense evasion and operational recovery by the attacker, BitPaymer can modify executable timestamps so encrypted files or components can later be identified and restored by a decryption tool.
BitPaymer has been distributed as a follow-on payload after earlier malware infections rather than solely through direct initial compromise. Documented delivery chains include Dridex-enabled intrusions and spam-driven botnet access sold to ransomware operators. It has also been associated with exploitation of known vulnerabilities in some campaigns. The malware primarily targets Windows environments and has been used against enterprises across multiple sectors, including manufacturing and industrial organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
For example, a vulnerability in Apple WebKitGTK (CVE-2019-8720) received a CVE from Red Hat in October 2019 was added to the KEV catalog in March because it was being exploited by BitPaymer ransomware.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
DoppelPaymer uses the same tactics, and much of the same code, as other ransomware threats known as BitPaymer and Maze.
Code for BitPaymer, also known as Friedex, includes numerous similarities to Dridex, despite its function as ransomware rather than data extraction.
From 2018 to 2019, TA551 gave the BitPaymer ransomware group access to its botnet, helping infect 72 U.S. companies and generate over $14.17 million in extortion payments.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Angelov and a co-manager monetized the botnet by selling access to individual compromised computers, known as bots. This access was sold to other criminal groups that typically carried out ransomware extortion schemes.
They then sold access to infected computers to other criminals, who used them to launch ransomware attacks, locking victims out of systems and demanding cryptocurrency payments to restore access.
Angelov and a co-manager monetized the botnet by selling access to individual compromised computers, known as bots. This access was sold to other criminal groups that typically carried out ransomware extortion schemes.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
They then sold access to infected computers to other criminals, who used them to launch ransomware attacks, locking victims out of systems and demanding cryptocurrency payments to restore access.
Angelov and a co-manager monetized the botnet by selling access to individual compromised computers, known as bots. This access was sold to other criminal groups that typically carried out ransomware extortion schemes.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
Angelov and a co-manager monetized the botnet by selling access to individual compromised computers, known as bots. This access was sold to other criminal groups that typically carried out ransomware extortion schemes.
The following analytic detects the writing of data with an IMPHASH value to an Alternate Data Stream (ADS) in the NTFS file system... This activity is significant as it may indicate a threat actor staging malicious code in hidden areas for persistence or future execution.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
"actors used the following command ... to obtain information about services: net start"; "APT1 used the commands net start and tasklist to get a listing of the services on the system"; "OilRig has used sc query on a victim to gather information about services"; "Indrik Spider has used the win32_service WMI class to retrieve a list of services"
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.
“actors used the following commands… to enumerate user accounts: net user >> %temp%\download; net user /domain >> %temp%\download … APT1 used the commands net localgroup, net user, and net group to find accounts… APT32 enumerated administrative users using the commands net localgroup administrators … OilRig has run net user, net user /domain, net group "domain admins" /domain …”
Once downloaded and active, Dridex has a wide range of capabilities, from downloading additional software to establishing a virtual network to deletion of files.
Trickbot is a cybercriminal group that has conducted ransomware campaigns across essential services including healthcare and banking.
Akira will delete system volume shadow copies via PowerShell commands. Avaddon deletes backups and shadow copies using native system tools. Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet. BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family mentioned as one of the strains transacting with Stern.
Ransomware used in attacks against U.S. companies after operators obtained access via the TA551/Mario Kart botnet.
Ransomware used in attacks against at least 72 U.S. companies via access provided by the phishing botnet managed by Angelov's group.
Ransomware that encrypts or locks victims out of their systems and demands cryptocurrency payment to restore access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.