Skip to main content
Darkfield

Operator dossier

bitpaymer (also tracked as FriedEx, IEncrypt) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 9 public victims claimed by this operator between August 25, 2017 and November 10, 2019. BitPaymer is a ransomware group first observed in August 2017, operating with a primary financial motivation and known for conducting targeted, high-value intrusions against enterprise environments rather than opportunistic mass campaigns. The group is widely attributed to the cybercriminal organization known as Evil Corp, a Russia-nexus threat actor led by Maksim Yakubov and associates previously linked to the Dridex banking trojan operations, functioning as a closely held, non-RaaS criminal enterprise rather than an open affiliate model. BitPaymer has been consistently delivered via Dridex as a post-compromise payload, with initial access typically achieved through phishing campaigns and malicious document lures, followed by extended dwell time for lateral movement and reconnaissance prior to encryption, with the group known to exfiltrate sensitive data as leverage in ransom negotiations. Notable campaigns include a 2017 attack against the National Health Service in Scotland and subsequent targeting of multiple U.S. municipal governments and private sector organizations, with the U.S. Treasury Department's Office of Foreign Assets Control sanctioning Evil Corp members in December 2019 in connection with BitPaymer operations, significantly complicating ransom payment pathways for victims. Based on publicly available telemetry reflecting nine known victims concentrated in the United States, Germany, Mexico, Spain, and France across manufacturing, telecommunications, agriculture and food production, energy, and technology sectors, BitPaymer activity has largely been superseded by successor ransomware variants attributed to Evil Corp including WastedLocker, Hades, and Phoenix CryptoLocker, representing a series of rebranding efforts likely undertaken to evade the consequences of the 2019 sanctions.

Most-targeted sectors

Most-affected countries

Recent disclosures by bitpaymer

All 9 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for bitpaymer →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

bitpaymer

aka FriedEx, IEncrypt · 9 victims indexed · first seen 9 years ago · last activity 7 years ago

9
Victims indexed
#214 of 364 tracked operators
2y 3m
Active period
Aug 2017 → Nov 2019
5
Countries hit
top US · 3

At a glance

Status
inactive
Aliases
FriedEx, IEncrypt
First seen
9 years ago
Last activity
7 years ago
Primary sector
Manufacturing · 2 hits

About

BitPaymer is a ransomware group first observed in August 2017, operating with a primary financial motivation and known for conducting targeted, high-value intrusions against enterprise environments rather than opportunistic mass campaigns. The group is widely attributed to the cybercriminal organization known as Evil Corp, a Russia-nexus threat actor led by Maksim Yakubov and associates previously linked to the Dridex banking trojan operations, functioning as a closely held, non-RaaS criminal enterprise rather than an open affiliate model. BitPaymer has been consistently delivered via Dridex as a post-compromise payload, with initial access typically achieved through phishing campaigns and malicious document lures, followed by extended dwell time for lateral movement and reconnaissance prior to encryption, with the group known to exfiltrate sensitive data as leverage in ransom negotiations. Notable campaigns include a 2017 attack against the National Health Service in Scotland and subsequent targeting of multiple U.S. municipal governments and private sector organizations, with the U.S. Treasury Department's Office of Foreign Assets Control sanctioning Evil Corp members in December 2019 in connection with BitPaymer operations, significantly complicating ransom payment pathways for victims. Based on publicly available telemetry reflecting nine known victims concentrated in the United States, Germany, Mexico, Spain, and France across manufacturing, telecommunications, agriculture and food production, energy, and technology sectors, BitPaymer activity has largely been superseded by successor ransomware variants attributed to Evil Corp including WastedLocker, Hades, and Phoenix CryptoLocker, representing a series of rebranding efforts likely undertaken to evade the consequences of the 2019 sanctions.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

7 months
2017-08-01T00:00:00+00:00 · 12018-07-01T00:00:00+00:00 · 12018-08-01T00:00:00+00:00 · 12018-11-01T00:00:00+00:00 · 12019-03-01T00:00:00+00:00 · 12019-10-01T00:00:00+00:00 · 22019-11-01T00:00:00+00:00 · 2
2017-08-01T00:00:00+00:002019-11-01T00:00:00+00:00

Top countries

🇺🇸 United States
3
🇩🇪 Germany
2
🇲🇽 Mexico
1
🇪🇸 Spain
1
🇫🇷 France
1
United States dossier →Germany dossier →Mexico dossier →Spain dossier →

Top sectors

Manufacturing
2
Telecommunication
1
Agriculture and Food Production
1
Energy
1
Technology
1
Public Sector
1
Healthcare
1
Hospitality and Tourism
1
Manufacturing dossier →Telecommunication dossier →Agriculture and Food Production dossier →Energy dossier →

MITRE ATT&CK

24 techniques · 9 tactics

Tactics

Initial AccessExecutionPersistenceDefense EvasionCredential AccessDiscoveryLateral MovementCollectionImpact

Techniques

  • T1566.001Phishing: Spearphishing Attachment
  • T1566.002Phishing: Spearphishing Link
  • T1078Valid Accounts
  • T1133External Remote Services
  • T1059.001Command and Scripting Interpreter: PowerShell
  • T1059.003Command and Scripting Interpreter: Windows Command Shell
  • T1106Native API
  • T1053.005Scheduled Task/Job: Scheduled Task
  • T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • T1036.005Masquerading: Match Legitimate Name or Location
  • T1027Obfuscated Files or Information
  • T1112Modify Registry
  • T1003.001OS Credential Dumping: LSASS Memory
  • T1110Brute Force
  • T1057Process Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1135Network Share Discovery
  • T1021.001Remote Services: Remote Desktop Protocol
  • T1021.002Remote Services: SMB/Windows Admin Shares
  • T1570Lateral Tool Transfer
  • T1486Data Encrypted for Impact
  • T1489Service Stop
  • T1490Inhibit System Recovery

Detection · YARA rules

1 rule

  • bitpaymer_ransomware

    YARA rule from ATR/Trellix: ransomware/RANSOM_Bitpaymer.yar

    source: ATR/Trellix

Recent victims

Loading…

Source

Updated 7 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time bitpaymer posts a victim.

Add bitpaymer to your watchlist — Pro pings you within 5 minutes of any new bitpaymer leak-site post, Telegram callout, or affiliate-rebrand inference.