Disclosure context

About bitpaymer

BitPaymer is a financially-motivated ransomware group that emerged in August 2017, operating as a targeted ransomware variant primarily focused on high-value enterprise victims rather than mass distribution campaigns. The group is believed to have connections to the Evil Corp cybercriminal organization and operates independently rather than as a Ransomware-as-a-Service model, with suspected ties to Eastern European threat actors. BitPaymer operators typically gain initial access through spear-phishing campaigns, exploit kits, or by leveraging compromised Remote Desktop Protocol (RDP) credentials, often using living-off-the-land techniques and legitimate administrative tools to move laterally through networks before deploying their custom ransomware payload that employs RSA and RC4 encryption algorithms. The group has been observed exfiltrating sensitive data before encryption to enable double extortion tactics, threatening to publicly release stolen information if ransom demands are not met. Notable BitPaymer campaigns have targeted critical infrastructure and large enterprises across the United States, Germany, France, Mexico, and Spain, with documented attacks against organizations in critical manufacturing, healthcare, government facilities, and IT sectors, though specific high-profile victims and ransom amounts have not been widely disclosed in public reporting. BitPaymer activity has significantly declined since 2019-2020, with many security researchers suggesting the group has either ceased operations or transitioned to other ransomware variants as law enforcement pressure increased on affiliated cybercriminal networks. The group has been linked to 9 public disclosures across our corpus. First observed on a leak site on August 25, 2017; most recent post November 10, 2019. The operation is currently inactive.

Also tracked as: FriedEx, IEncrypt.

Timeline of this disclosure

October 12, 2019M6 listed by bitpaymeron the group's public leak site

Sector and geography

This disclosure adds to ransomware activity in the Communication sector, which has 24 disclosures indexed across all operators we track. Geographically, M6 is reported in France, a country with 472 ransomware disclosures in our corpus.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.

Ransomware victim disclosure

← All victims

M6

Claimed by bitpaymer · listed 7 years ago

80m

Age

since listed · data leaked

Status timeline

Listed
Oct 12, 2019
Data leaked

At a glance

Group: bitpaymer
Status: Data leaked
Country: France
Sector: Communication
Listed on leak site: Oct 12, 2019

About the victim

AI dossier — public-source company profile

M6 (Métropole Télévision) is a major French commercial television broadcaster headquartered in Neuilly-sur-Seine, France. It operates the M6 channel along with several other free-to-air and pay-TV channels, and runs the streaming platform M6+ (6play). The group is one of France's largest private audiovisual media companies, reaching millions of viewers nationally.

Industry: Broadcast Television & Streaming Media
Address: 89 avenue Charles de Gaulle, 92575 Neuilly-sur-Seine Cedex, France
Employees: 1001-5000
Founded: 1987

Attack summary

Severity: high — Data is marked as published by a known ransomware group targeting a large national broadcaster, implying confirmed exfiltration of significant business data; the scale of M6's operations and potential subscriber/employee PII elevates severity, though no specific regulated data categories are confirmed from the available evidence.

BitPaymer ransomware operators claim an attack on M6 with data published status indicated, suggesting exfiltration and/or encryption occurred and data has been released; no specific data volume or ransom amount was stated in the available post.

high

Data the group says was taken

AI dossier — extracted from the leak post

Internal business documents
Corporate files
Potentially employee PII
Potentially subscriber/customer data

Sources

Victim sitem6.fr

Source

Indexed 7 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.