payload ransomware group
Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.
- Claims in 7 days
- 4
- Claims in 30 days
- 15
- Reported techniques
- 11
Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.
Where it claims victims
| Country | Claims in 60 days |
|---|---|
| Germany | 10 |
| France | 1 |
Sectors
| Sector | Claims in 60 days |
|---|---|
| Manufacturing | 5 |
| Retail & E-Commerce | 3 |
| Professional Services | 2 |
| Transportation | 1 |
| Education | 1 |
| Government & Defense | 1 |
Reported techniques
Native APIObfuscated Files or InformationIndicator RemovalExecution GuardrailsProcess DiscoverySystem Information DiscoveryFile and Directory DiscoveryData Encrypted for ImpactService StopInhibit System RecoveryDisable or Modify Tools