Overview
Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.
- First tracked: 2026-02-17
- Discussed in our reports: Bahrain · France · Gulf summary · Maghreb · Qatar · Türkiye · UAE
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
Switzerland7
Germany6
United States of America5
Singapore4
Philippines4
Malaysia3
Egypt3
Italy2
Dominican Republic2
Canada2
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Stealth (TA0005)
- T1027 · Obfuscated Files or Information: RC4-encrypted strings, double-base64 note key
- T1070.004 · File Deletion: Self-delete via NTFS ADS rename ( :payload stream)
- T1480 · Execution Guardrails: Mutex "MakeAmericaGreatAgain"
Discovery (TA0007)
- T1082 · System Information Discovery: CPUID for AVX2/SSE2, GetLogicalProcessorInformation
- T1083 · File and Directory Discovery: Recursive traversal via NtQueryDirectoryFile
Impact (TA0040)
- T1489 · Service Stop: 44 services stopped via SCM (backup, AV, database)
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| Loading http://payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd.onion/ | DLS | payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd[.]onion | No |
| Payload Rescue | Login | Chat | payloadynyvabjacbun4uwhmxc7yvdzorycslzmnleguxjn7glahsvqd[.]onion | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11