BitPaymer/IEncrypt ransomware

This ANSSI report details the BitPaymer (aka IEncrypt/FriedEx) ransomware used in targeted, manually-operated campaigns since 2017, its infection methods (phishing, compromised websites, weak RDP, third-party compromise), TTPs (credential theft, lateral movement, disabling AV, wiping shadow copies), a DoppelPaymer variant emergence, observed impacts (including Scottish hospitals and US municipalities), and practical detection/mitigation guidance such as a Morphisec YARA rule and backup/Active Directory hardening recommendations.