Group profile12 claimed in last 30d57 total tracked

payload

Forward this

Payload has claimed 12 victims in the past 30 days, with activity concentrated in Switzerland and Germany and a manufacturing-sector focus that also touches business services, hospitality, and technology firms; recent claims include B&B Hydraulik, Stücheli Architekten, and Baya Technologies. The group is described in its own materials as running Babuk-derived, cross-platform encryptors against both Windows and ESXi environments, though that lineage claim should be treated as unverified attacker messaging rather than confirmed fact. Cataloged techniques show a focus on evasion and disruption before encryption: strings are RC4-encrypted with a double-base64 note key, the binary self-deletes via an NTFS alternate-data-stream rename, and the malware performs CPU feature checks (AVX2/SSE2) before halting roughly 44 services, including backup agents, antivirus, and database processes, via the Service Control Manager. Since surfacing in mid-2026 the group has moved quickly, racking up 55 claimed victims across seven countries within months, with Swi

Brief by The Nexus · Aug 15 · 15:03 UTC

Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.

First seen: May 19 · 07:54 UTCLast seen: Aug 20 · 17:26 UTCTracked since: 2026-02-17

Sectors hit

Manufacturing7
Business Services4
Technology3
Hospitality and Tourism3
Public Sector2
Professional Services2
Unspecified2
Healthcare2

Countries hit

Switzerland6
Germany4
Singapore3
South Africa1
Vietnam1
United States1
Taiwan1
Türkiye1
Malaysia1
Japan1

MITRE ATT&CK · observed TTPs5 tactics

Tactics and techniques attributed to PAYLOAD by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

TA0002Execution
- T1106Native API
TA0005Stealth
- T1027Obfuscated Files or Information
  RC4-encrypted strings, double-base64 note key
- T1070.004File Deletion
  Self-delete via NTFS ADS rename ( :payload stream)
- T1480Execution Guardrails
  Mutex "MakeAmericaGreatAgain"
TA0007Discovery
- T1057Process Discovery
- T1082System Information Discovery
  CPUID for AVX2/SSE2, GetLogicalProcessorInformation
- T1083File and Directory Discovery
  Recursive traversal via NtQueryDirectoryFile
TA0040Impact
- T1486Data Encrypted for Impact
- T1489Service Stop
  44 services stopped via SCM (backup, AV, database)
- T1490Inhibit System Recovery
TA0112Defense Impairment
- T1685Disable or Modify Tools

Recent claimed victims

Aug 20 · 19:48 UTC

Qualiflex Datacenter | HWZ-Studiengnge (fh-hwz.ch), myenb.ch, etc

Qualiflex Datacenter | HWZ-Studiengnge (fh-hwz.ch), myenb.ch, etc

Zara Investment Holding

Zara Investment Holding

B&B Hydraulik

Stücheli Architekten

Baya Technologies

B&B Hydraulik

Stücheli Architekten

Baya Technologies

Hans & Jos. Kronenberg GmbH

Hans & Jos. Kronenberg GmbH

CKR Consulting Engineers

CKR Consulting Engineers

Roofinox

Roofinox

The commune of Castries

The commune of Castries

ENB Versich

Vela Film S.r.l.

Vela Film S.r.l.

Tofutown

Tofutown

Villea Hotels in AttanaHo

Mosaic Partners

Clínica La Sabana

Software Arge

Clínica La Sabana

Software Arge

Mosaic Partners

A

ENB Versicherungen | myenb.ch

Editora Irmãos Vitale

Qualiflex Solutions | qualiflex.solutions

Preferred Properties

ENB Versicherungen | myenb.ch

Editora Irmãos Vitale

Qualiflex Solutions | qualiflex.solutions

Qualiflex Solutions | qualiflex.solutions

Preferred Properties

SPORTON International Inc.

SPORTON International Inc.

myipo.gov.my

myipo.gov.my

Plaza Lama

Hansoll Textile in Vietnam

Villea Hotels in AttanaHotels

Plaza Lama

Hansoll Textile in Vietnam

Villea Hotels in AttanaHotels

G Theodor Freese

A-Sonic Logistic Solutions

Internal Medicine and Pediatrics of Cullman

Robinsons

Tang Seng Nitrogen & Pump Systems Pte. Ltd.

Elohim Law Corporation

Kabushiki Gaisha Hodozuka Setsubi