Group profile32 claimed in last 30d39 total tracked

payload

Forward this

Payload has claimed 26 victims in the past 30 days alone, out of 33 total since emerging in May 2026, making it one of the more active newcomers on the current tracker. This week's claims include a Costa Rican healthcare clinic, a Swiss business services firm, and a Turkish technology company, with Singapore and Switzerland each accounting for three victims overall and manufacturing and business services as the most frequently targeted sectors. The group is built on Babuk-derived source code and targets both Windows and ESXi environments; its tooling stops 44 services via Windows Service Control Manager before encrypting, specifically gutting backup, antivirus, and database processes, and the malware deletes itself post-execution by renaming its own binary to an NTFS alternate data stream, leaving minimal forensic residue. RC4-encrypted strings and a double-base64-encoded ransom note key are used to complicate static analysis. The group claims cross-platform double-extortion capability and its rapid early cadence, 12 claimed victims within hours of its leak site going live, suggests an operation that arrived with infrastructure and targeting lists already prepared.

Brief by The Nexus · Jun 27 · 15:02 UTC

Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.

First seen: May 19 · 07:54 UTCLast seen: Jul 5 · 21:35 UTCTracked since: 2026-02-17

Sectors hit

Manufacturing5
Business Services4
Hospitality and Tourism3
Unspecified2
Healthcare2
Consumer Services2
Transportation/Logistics1
Technology1

Countries hit

Switzerland4
Singapore3
Germany2
Vietnam1
United States1
Taiwan1
Türkiye1
Malaysia1
Japan1
Italy1

MITRE ATT&CK · observed TTPs5 tactics

Tactics and techniques attributed to PAYLOAD by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

TA0002Execution
- T1106Native API
TA0005Stealth
- T1027Obfuscated Files or Information
  RC4-encrypted strings, double-base64 note key
- T1070.004File Deletion
  Self-delete via NTFS ADS rename ( :payload stream)
- T1480Execution Guardrails
  Mutex "MakeAmericaGreatAgain"
TA0007Discovery
- T1057Process Discovery
- T1082System Information Discovery
  CPUID for AVX2/SSE2, GetLogicalProcessorInformation
- T1083File and Directory Discovery
  Recursive traversal via NtQueryDirectoryFile
TA0040Impact
- T1486Data Encrypted for Impact
- T1489Service Stop
  44 services stopped via SCM (backup, AV, database)
- T1490Inhibit System Recovery
TA0112Defense Impairment
- T1685Disable or Modify Tools

Recent claimed victims

EnergySwitzerlandJul 5 · 21:36 UTC

ENB Versich

Vela Film S.r.l.

Vela Film S.r.l.

Tofutown

Tofutown

Villea Hotels in AttanaHo

Mosaic Partners

Clínica La Sabana

Software Arge

Clínica La Sabana

Software Arge

Mosaic Partners

A

ENB Versicherungen | myenb.ch

Editora Irmãos Vitale

Qualiflex Solutions | qualiflex.solutions

Preferred Properties

ENB Versicherungen | myenb.ch

Editora Irmãos Vitale

Qualiflex Solutions | qualiflex.solutions

Qualiflex Solutions | qualiflex.solutions

Preferred Properties

SPORTON International Inc.

SPORTON International Inc.

myipo.gov.my

myipo.gov.my

Plaza Lama

Hansoll Textile in Vietnam

Villea Hotels in AttanaHotels

Plaza Lama

Hansoll Textile in Vietnam

Villea Hotels in AttanaHotels

G Theodor Freese

A-Sonic Logistic Solutions

Internal Medicine and Pediatrics of Cullman

Robinsons

Tang Seng Nitrogen & Pump Systems Pte. Ltd.

Elohim Law Corporation

Kabushiki Gaisha Hodozuka Setsubi