payload

87 tracked victims

·first seen 2026-02-17·last activity 2026-10-28

Activity analysis

HackerFeeds has tracked 89 victims claimed by payload since February 2026, most recently in November 2026 — ranking #80 of 332 groups (0.3% of all tracked ransomware victims). It posted 18 victims in the last 90 days, down 40% on the previous 90 days (30). Its most-targeted sector is Manufacturing (20 victims), followed by Business Services (8). Germany accounts for 14 victims (18% of those with a known location); 11 victims did not disclose a location.

Victims per year

202689

Top sectors

Manufacturing20
Business Services8
Financial Services6
Consumer Services6
Hospitality and Tourism5
Healthcare5

Top countries

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.

MITRE ATT&CK TTPs

TA0002

Execution

T1106Native API

TA0005

Stealth

T1027Obfuscated Files or Information
RC4-encrypted strings, double-base64 note key
T1070.004File Deletion
Self-delete via NTFS ADS rename ( :payload stream)
T1480Execution Guardrails
Mutex "MakeAmericaGreatAgain"

TA0007

Discovery

T1057Process Discovery
T1082System Information Discovery
CPUID for AVX2/SSE2, GetLogicalProcessorInformation
T1083File and Directory Discovery
Recursive traversal via NtQueryDirectoryFile

TA0040

Impact

T1486Data Encrypted for Impact
T1489Service Stop
44 services stopped via SCM (backup, AV, database)
T1490Inhibit System Recovery

TA0112

Defense Impairment

T1685Disable or Modify Tools

Recent victims

showing 50 of 87

Date	Website / victim	Sector	Country
2026-11-03	S Stahlbau Mann GmbH	Manufacturing	DE
2026-10-31	S Straze Garden Center	Retail & E-Commerce
2026-10-31	Kraft Lernenkraft-lernen.de	Education	DE
2026-10-31	S SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH)	Government & Defense	DE
2026-10-28	Hauhincohauhinco.de	Manufacturing	DE
2026-10-28	M Marbre Design	Manufacturing	FR
2026-10-26	G Glückauf-Vermessung GmbH	Professional Services	DE
2026-10-26	M Miletic GmbH	Not Found	DE
2026-10-26	E Edelstahl-Mechanik GmbH	Manufacturing	DE
2026-10-20	B BW Office World	Retail & E-Commerce
2026-10-20	B Brüninghoff Group	Manufacturing	DE
2026-10-08	Boullard Musiqueboullard.ch	Retail & E-Commerce	CH
2026-09-28	N Netech (Neeser Technik AG)	Manufacturing	CH
2026-08-20	Qualiflex Datacenter \| HWZ-Studiengnge (fh-hwz.ch), myenb.ch, etcfh-hwz.ch	Technology	CH
2026-08-13	Zara Investment Holdingzaraholding.com	Financial Services	JO
2026-08-11	B B&B Hydraulik	Manufacturing	DE
2026-08-11	Stücheli Architektenstuecheli.ch	Professional Services	CH
2026-08-11	B Baya Technologies	Technology
2026-08-03	Hans & Jos. Kronenberg GmbHkronenberg-gmbh.de	Manufacturing	DE
2026-07-19	CKR Consulting Engineersckr.co.za	Professional Services	ZA
2026-07-10	R Roofinox	Manufacturing
2026-07-09	The commune of Castriescastries.fr	Government & Defense	FR
2026-07-05	E ENB Versich	Energy & Utilities	CH
2026-07-05	V Vela Film S.r.l.	Retail & E-Commerce	IT
2026-07-02	T Tofutown	Agriculture and Food Production	DE
2026-06-29	V Villea Hotels in AttanaHo	Hospitality
2026-06-26	Clínica La Sabanaclinicalasabana.com	Healthcare	CR
2026-06-26	Software Argesoftwarearge.com	Technology	TR
2026-06-26	Mosaic Partnersmosaic-partners.com	Professional Services	CH
2026-06-20	E ENB Versicherungen \| myenb.ch	Financial Services	CH
2026-06-20	E Editora Irmãos Vitale	Education	BR
2026-06-20	P Preferred Properties	Retail & E-Commerce
2026-06-16	SPORTON International Inc.sporton.com.tw	Manufacturing	TW
2026-06-13	myipo.gov.mymyipo.gov.my	Government & Defense	MY
2026-06-08	Plaza Lamaplazalama.com.do	Hospitality	DO
2026-06-08	Hansoll Textile in Vietnamhansoll.com	Manufacturing	VN
2026-06-08	Villea Hotels in AttanaHotelsvillea.attanahotels.com	Hospitality	MY
2026-05-21	G Theodor Freesegtf-freese.de	Manufacturing	DE
2026-05-21	A-Sonic Logistic Solutionsasonic-logisticsolutions.com	Transportation
2026-05-21	Internal Medicine and Pediatrics of Cullmanimpcullman.com	Healthcare	US
2026-05-21	R Robinsons	Retail & E-Commerce	SG
2026-05-19	Tang Seng Nitrogen & Pump Systems Pte. Ltd.tangsengservices.com	Manufacturing	SG
2026-05-19	Elohim Law Corporationelohimlaw.com	Professional Services	SG
2026-05-19	K Kabushiki Gaisha Hodozuka Setsubi	Manufacturing	JP
2026-05-13	Gorey Community Schoolgoreycs.ie	Education	IE
2026-05-13	Inteceng.com.my (+ Tsksynergy.com.my + Amemanufacturing.com.my + Woodnova.com.my)Inteceng.com.my	Manufacturing	MY
2026-04-29	P PROM (Peakside Ros Outlet Management)	Retail & E-Commerce
2026-04-27	Rural Municipality of Gimligimli.ca	Government & Defense	CA
2026-04-23	Peroni Sosa Tellechea Burt & Narvajapstbn.com.py	Professional Services	UY
2026-04-23	meditron.com.vemeditron.com.ve	Healthcare	VE