Loading malware…
PayloadBIN is a Windows ransomware family associated with the Evil Corp cybercrime cluster and widely assessed as part of the same lineage as WastedLocker, Hades, and Phoenix Locker. It emerged as a continuation or rebranding of Phoenix Locker during Evil Corp’s broader pattern of renaming ransomware operations after U.S. sanctions complicated ransom payment facilitation and increased attribution pressure. Some reporting has also noted that attacks involving PayloadBIN may have been misattributed to other actors because of this deliberate rebranding strategy.
PayloadBIN encrypts victim files and is reported to append a distinctive new extension to encrypted data while dropping a ransom note identifying the PayloadBIN brand. Code-analysis reporting has linked it closely to Phoenix Locker and, by extension, to Hades and WastedLocker, citing substantial overlap in core functionality such as file enumeration and other implementation details. It has also been tied to the same broader tooling ecosystem used by Evil Corp, including packed samples associated with CryptOne in the relevant period.
Operationally, PayloadBIN fits the Evil Corp model of targeted enterprise ransomware intrusions rather than indiscriminate commodity deployment. Across this lineage, intrusions have involved initial access through phishing-delivered Dridex in earlier periods and later shifts toward SocGholish and Cobalt Strike to obscure attribution, with post-compromise activity including credential theft, reconnaissance, lateral movement, data exfiltration, and defense evasion before encryption. PayloadBIN has also been referenced in connection with Yanluowang-linked activity, indicating either shared use, code access, or attribution confusion around some incidents. The malware is primarily associated with financially motivated attacks against corporate environments across multiple sectors.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Beyond targets, the chat logs also highlighted Yanluowang’s use of the ransomware, PayloadBIN but also that attacks that involved it may potentially have been misattributed to another ransomware actor, Evil Corp.
"...shifted to using ransomware variants such as ... Payload.bin."
11 distinct techniques documented for this family, organized by ATT&CK tactic.
cmd /c waitfor /t 10 pause /d y & attrib -h ... & del ... & rd ...
written to payload.bin in the package install directory, chmod 0755’d, and spawned detached... Detached child process spawned by node.exe with __DAEMONIZED=1
written to payload.bin in the package install directory, chmod 0755’d, and spawned detached... Detached child process spawned by node.exe with __DAEMONIZED=1
From Hades onwards, we found a unique self-delete implementation including the waitfor command.
calls STS GetCallerIdentity / AssumeRole, and enumerates Secrets Manager (ListSecrets / GetSecretValue) across 16+ regions | npm: validates tokens through /-/whoami and enumerates publish access through /-/npm/v1/tokens... Stolen npm publish tokens enable downstream supply-chain pivoting
AWS: queries EC2 Instance Metadata Service v2 (169.254.169[.]254), Elastic Container Service task metadata (169.254.170[.]2)
Once installed, the packages harvest AWS credentials, HashiCorp Vault tokens, and CI/CD pipeline secrets from the host environment.
enumerates Secrets Manager (ListSecrets / GetSecretValue) across 16+ regions with a bundled SigV4 signer.
preinstall.js collects rich host context... and POSTs it to the actor’s C2 with a campaign-unique header X-Supply: 1. The same C2 endpoint then serves a gunzip-compressed second-stage binary
an older generation that contacts an external command-and-control server to fetch its payload, and a newer, stealthier generation that silently downloads the legitimate Bun runtime and uses it to run a pre-bundled malicious script hidden inside the npm tarball.
When installed, the ransomware will append the .PAYLOADBIN extension to encrypted files... the ransom note is named 'PAYLOADBIN-README.txt' and states that the victim's 'networks is LOCKED with PAYLOADBIN ransomware.'
All ransomwares have the same implementation of Shadows copy deletion: C:\Windows\system32\vssadmin.exe Delete Shadows / All /Quiet
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.