Threat intelligence / Malware

BitPaymer

[BitPaymer](https://attack.mitre.org/software/S0570) is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. [BitPaymer](https://attack.mitre.org/software/S0570) uses a unique encryption key, ransom note, and contact information for each operation. [BitPaymer](https://attack.mitre.org/software/S0570) has several indicators suggesting overlap with the [Dridex](https://attack.mitre.org/software/S0384) malware and is often delivered via [Dridex](https://attack.mitre.org/software/S0384).(Citation: Crowdstrike Indrik November 2018)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BitPaymer](https://attack.mitre.org/software/S0570) is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. [BitPaymer](https://attack.mitre.org/software/S0570) uses a unique encryption key, ransom note, and contact information for each operation. [BitPaymer](https://attack.mitre.org/software/S0570) has several indicators suggesting overlap with the [Dridex](https://attack.mitre.org/software/S0384) malware and is often delivered via [Dridex](https://attack.mitre.org/software/S0384).(Citation: Crowdstrike Indrik November 2018)

Labels

malware

19 recorded

Relationships

uses

to Bypass User Account Control

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to Inhibit System Recovery

Technique

uses

to Local Account

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to NTFS File Attributes

Technique

uses

to Query Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote System Discovery

Technique

uses

to System Service Discovery

Technique

uses

Technique

uses

to Token Impersonation/Theft

Technique

uses

to Windows Permissions

Technique

uses

to Windows Service

Technique

uses

from Indrik Spider

Group

5 external

References

mitre-attack

S0570

BitPaymer

—

wp_encrypt

—

FriedEx

—

Crowdstrike Indrik November 2018

https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/