Loading story…
Payload Ransomware claimed it breached Royal Bahrain Hospital in Bahrain and stole 110 GB of data, then listed the hospital on its Tor leak site with a deadline to pay before the data is released. The reporting says the gang published screenshots or images of allegedly compromised systems as proof of access, and described Payload as a relatively new double-extortion operation targeting mid- to large-sized organizations, including healthcare entities, with pressure tactics based on both data theft and encryption.
Technical analysis of the Payload malware links the operation to a Babuk-derived codebase and says the ransomware uses ChaCha20 for file encryption and Curve25519 for key exchange, with no identified cryptographic weakness that would allow recovery without the attackers' private key. Researchers also noted distinctive detection artifacts, including a 56-byte footer encrypted with an RC4 key of FBI, and assessed that while Payload has been described as ransomware-as-a-service, there is no public evidence yet confirming an affiliate program; what is confirmed is the group's recent activity, leak-site operations, and the Royal Bahrain Hospital claim as one of its named victims.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-15, the Payload ransomware group listed Royal Bahrain Hospital on its Tor leak site, alleging it stole 110 GB of data. The group published screenshots of allegedly compromised systems and threatened to release the data if a ransom was not paid by 2026-03-23.
Derp.Ca analyzed Payload's Windows and Linux/ESXi variants and concluded the ransomware is heavily derived from the leaked Babuk source code, with modifications including ChaCha20 encryption, Curve25519 key exchange, ETW patching, event log wiping, and anti-forensic self-deletion. The analysis also noted 12 claimed victims across seven countries totaling 2,603 GB of allegedly stolen data.
Researchers reported that the Payload ransomware strain has been active since at least 2026-02-17, targeting organizations in multiple sectors and countries using a double-extortion model.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcederp.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Payload** is a newly observed ransomware strain targeting Windows environments and rapidly expanding its operations, with about 50 victims listed on its leak site by late March. The malware appends the `.payload` extension to encrypted files and drops a ransom note named `RECOVER_payload.txt`, while focusing on sectors where downtime can quickly drive extortion pressure, including logistics, transportation, construction, real estate, manufacturing, and technology. Technical analysis indicates Payload uses a mature cryptographic design built on per-file **Curve25519 ECDH** key exchange and **ChaCha20** encryption, making recovery without the operators’ private key effectively infeasible. The ransomware also uses aggressive anti-forensics and disruption tactics before encryption, including deleting shadow copies, clearing Windows Event Logs, patching ETW-related functions in `ntdll`, terminating processes, and stopping backup and database services. Separate reporting on **Vect** highlighted a contrasting trend in the ransomware ecosystem: although Vect marketed enterprise-focused cross-platform ransomware for Windows, Linux, and ESXi, researchers found a critical cryptographic flaw that irreversibly destroys files larger than 128 KB, effectively turning many attacks into data wiping events even if victims pay. Together, the findings show a split between technically competent operators such as Payload and poorly engineered ransomware like Vect that can still cause severe business disruption.
Jun 29, 2026
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former **Conti** members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached **$25 million** in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, **FRwL / UAC-0118**, and earlier ex-Conti-linked operations, including shared IPs and a **Cobalt Strike** watermark associated with related campaigns. Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed **RDP**, and compromised credentials. After entry, the actors have used **BATLOADER**, **Qakbot**, **Bokbot**, **Cobalt Strike**, **PsExec**, **PowerShell**, **AdFind**, **NetScan**, **Chisel**, **Rclone**, **PCHunter**, **PowerTool**, and **Process Hacker** to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/**ESXi** ELF variant. Royal typically encrypts local drives and network shares, appends the `.royal` extension, deletes shadow copies, disables security services, and leaves `README.txt` ransom notes with Tor-based contact instructions. Defenders are urged to prioritize **software patching**, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Aug 15, 2026
Attackers used the low-cost **Philadelphia** ransomware to run targeted campaigns against healthcare institutions and other organizations in the same city, delivering malware through spoofed internal-looking emails themed around patients and linked via `bit.do` URLs. The operation stood out because ransom notes were customized with victim organization names, demanded **15 Bitcoin**, and threatened to delete files on a timed schedule, showing a level of personalization more often associated with higher-end ransomware operations. Proofpoint reported that Philadelphia supported multiple delivery paths, including zipped executables linked from emails, macro-enabled Word documents that launched PowerShell, bundled installers on keygen and cracking sites, and distribution through the **Sundown** and **RIG** exploit kits. Its server-side configuration let operators set ransom amounts, Bitcoin addresses, victim IDs, and payment confirmation requirements, underscoring how commodity ransomware had evolved into a flexible platform for more tailored and aggressive attacks.
Aug 14, 2026