Home / Ransomware Intelligence / All groups / payload

payload Ransomware

Tracked since Feb 17, 2026

victims recorded

in the last 30 days

CVEs

—

Last activity

Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.

Vulnerabilities cited for this group

CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.

No CVE associated with this group in the sources.

Tactics and techniques (MITRE ATT&CK)

Execution

T1106 Native API

Stealth

T1027 Obfuscated Files or Information T1070.004 File Deletion T1480 Execution Guardrails

Discovery

T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery

Impact

T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery

Defense Impairment

T1685 Disable or Modify Tools

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live