BitPaymer

BitPaymer is a type of malware, specifically ransomware, that was operated by the cybercriminal group known as GOLD DRAKE. It is designed to infiltrate systems and encrypt data, holding it hostage until a ransom is paid. This malicious software became prominent in conjunction with the rise of Ransomware as a Service (RaaS) model during 2020. BitPaymer has been linked to first-stage malware attacks such as Dridex, which were used to establish initial access before launching the ransomware. The GOLD DRAKE threat group later reworked BitPaymer and renamed it as DoppelPaymer, under the operation of the GOLD HERON threat group. BitPaymer's development and distribution were overseen by Evil Corp, a financially motivated Russian cybercriminal group established in 2014. This group utilized BitPaymer in combination with its long-running Dridex banking Trojan to target banks and financial institutions in over 40 countries, leading to criminal profits of over $100 million. Aleksandr Ryzhenkov, a member of Evil Corp, was indicted in the United States for his involvement with BitPaymer ransomware, and he has been sanctioned in the U.S., United Kingdom, and Australia for affiliating with LockBit. BitPaymer operates by attempting to enumerate the sessions for each user logged onto the infected host and creating a new process using the token of each user. In doing so, it can encrypt network shares and disrupt operations. However, certain defenses can stop the BitPaymer process before it can encrypt any files. CrowdStrike Falcon® Prevent is one such defense mechanism that has shown effectiveness against BitPaymer, as evidenced by the SHA256 hashes for BitPaymer samples analyzed by Falcon Intelligence.