Payload — Ransomware Profile
Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.IntelFusions coverage (1)
- Group Policy alone put ransom notes on every PC 2026-09-21 · Ransomware
Tools & malware
- Payload Ransomware Ransomware
Recent claimed victims
- Autohaus Arnold 2026-11-07
- Otto Stops 2026-11-07
- Brauco 2026-11-07
- Schroers Ingenieure 2026-11-07
- Stahlbau Mann GmbH 2026-11-03
- Kraft Lernen 2026-10-31
- SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) 2026-10-31
- Straze Garden Center 2026-10-31
- Marbre Design 2026-10-28
- Hauhinco 2026-10-28
- Glückauf-Vermessung GmbH 2026-10-26
- Edelstahl-Mechanik GmbH 2026-10-26
- Miletic GmbH 2026-10-26
- Brüninghoff Group 2026-10-20
- BW Office World 2026-10-20
- Boullard Musique 2026-10-08
- Netech (Neeser Technik AG) 2026-09-28
- Qualiflex Datacenter | HWZ-Studiengnge (fh-hwz.ch), myenb.ch, etc 2026-08-20
- Zara Investment Holding 2026-08-13
- Baya Technologies 2026-08-11
- Stücheli Architekten 2026-08-11
- B&B Hydraulik 2026-08-11
- Hans & Jos. Kronenberg GmbH 2026-08-03
- CKR Consulting Engineers 2026-07-19
- Roofinox 2026-07-10
Vendor research
- the team's report Kaspersky
- Payload (Threat Group Profile) Halcyon