Payload
Payload is a ransomware operation first observed in February 2026. It is described as a relatively new, active double-extortion group that combines data theft with file encryption, and has been tracked as an emerging ransomware operation with international ambitions. Public reporting in the provided content places its victims across multiple countries and sectors, including real estate, energy, healthcare, telecom, agriculture, logistics, transportation, construction, manufacturing, technology, and healthcare entities such as smaller providers and clinics. The content also notes a claimed March 15, 2026 breach of Royal Bahrain Hospital involving 110 GB of allegedly stolen data. Operationally, Payload has been described in some reporting as part of the 2026 ransomware-as-a-service ecosystem, but the strongest technical reporting in the provided content states that public claims of a RaaS model are unverified because no public evidence of an affiliate program or builder panel was identified. Technically, Payload supports Windows and Linux/ESXi environments. It appends the .payload extension to encrypted files and drops a ransom note named RECOVER_payload.txt. The malware uses Curve25519 ECDH for per-file key agreement and ChaCha20 for file encryption, with a per-file encryption model and a 56-byte footer RC4-encrypted with the key "FBI." Reported anti-forensics and defense-evasion behavior includes deleting shadow copies, clearing Windows Event Logs, patching ETW-related functions in ntdll, terminating numerous services and processes including backup and database software, emptying the recycle bin, and self-deletion via NTFS alternate data streams. The Linux/ESXi variant parses VMware inventory data to locate VM disk paths. Reporting in the content assesses Payload as heavily derived from the leaked Babuk source code, with modifications including ChaCha20-based encryption, ETW patching, full Windows event log wiping, and NTFS ADS self-deletion. Aliases directly reflected in the content: Payload, Payload ransomware, Payload Ransomware group.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financial Services
- Capital Goods
- Academia & Research
- Consumer Services
Where they target
Geographies tied to known operations.
- 🇨🇾 Cyprus
- 🇦🇹 Austria
- 🇵🇱 Poland
- 🇳🇴 Norway
- 🇸🇬 Singapore
- 🇯🇵 Japan
Tradecraft
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Emerging ransomware operation conducting global extortion attacks via a leak site and negotiation portal, targeting organizations where downtime creates immediate financial pressure.
Named as one of five ransomware operators publishing new victims on DLS infrastructure in a single day as part of the fragmented 2026 RaaS landscape.
A ransomware operator that remained visible despite a moderate decline in incidents.
Active ransomware used in targeted campaigns against smaller healthcare providers and clinics.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.