BitPaymer

BitPaymer is a type of malware that operates as ransomware, encrypting files and demanding payment for their release. It was operated by the GOLD DRAKE threat group and was later reworked and renamed DoppelPaymer by the GOLD HERON threat group. As part of the Ransomware as a Service (RaaS) model that gained traction in 2020, BitPaymer was often deployed in conjunction with other first-stage malware such as Dridex. This relationship between different types of malware established a more complex attack framework, leading to an increase in successful ransomware attacks. To execute its malicious activities, BitPaymer would attempt to enumerate the sessions for each user logged onto the infected host and create a new process using the token of each user. In some instances, there was observed inactivity between the time the domain controllers were compromised and the installation of BitPaymer. Once active, BitPaymer could be stopped before it encrypted any files if certain defenses were in place. Falcon Intelligence acquired multiple decryption tools related to BitPaymer, confirming the theory that a unique key was used for each infection. Falcon Intelligence has been involved in multiple incident response engagements related to BitPaymer. They have analyzed numerous BitPaymer samples, providing SHA256 hashes for these instances. Their analysis also revealed two different methods used to deploy BitPaymer once the domain controllers were compromised. Unlike other ransomware like Hades or WastedLocker, BitPaymer creates a note for each encrypted file, which could potentially provide additional information for cybersecurity experts working on decrypting the affected files.