BitPaymer
Software · ATTACK:enterprise:S0570
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0570",
"title": "BitPaymer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0570",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--fa766a65-5136-4ff3-8429-36d08eaa0100",
"external_id": "S0570",
"domain": "enterprise",
"created": "2021-02-08T22:19:19.340Z",
"modified": "2024-04-11T02:52:57.879Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "BitPaymer"
},
{
"source_name": "wp_encrypt"
},
{
"source_name": "FriedEx"
},
{
"source_name": "Crowdstrike Indrik November 2018",
"url": "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c8370b1-efd1-4e5d-86c9-d3ffba1bb22d
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cc1c2b0-5fb8-420e-8285-db4616a9fab2
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3dbc782c-2030-4b32-9bf7-36c65bc9e749
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c8da471-3483-4f75-8e1a-952d2d05454d
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54f9c8a5-0677-4be8-bd72-a6a096be00bd
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5793708d-b25a-4276-9b0b-697a8494e0f8
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ec68d1c-9ba8-4f9c-b185-f4e8482a66b2
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6743c3f6-7f4f-40b3-bc9e-fe488f81f5e1
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1134.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6edd6f1b-3907-4013-b2e0-ceb03ccf427a
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d71658b-2b9f-4639-9fe7-7c7924b52ff7
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--833e14f8-0f37-488a-a67c-3ff2fe524ac3
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ddf6a79-a4ff-4229-9923-bec8fe120ceb
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1862cc9-ba25-4d48-b2d5-55781dd1fa3e
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1564.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c42f802b-394c-4d6f-bc3f-bf039c971cae
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0162247-12e2-4c0e-8efe-d5c4823e0fcd
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d17ee0b3-4f2b-4d6f-ae10-7934d4e9126d
Crowdstrike Indrik November 2018ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcafed44-9d31-4d75-915f-660f5fd62fed
Crowdstrike Indrik November 2018 · Crowdstrike EvilCorp March 2021ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e811f6e8-a736-4bb8-8cd9-c6edc9a7ebd8
Crowdstrike Indrik November 2018ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f66247c0-1d4b-475b-8336-04530edb1455
Crowdstrike Indrik November 2018