payload

Profile

Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.

Tactics and techniques (MITRE ATT&CK)

Execution

T1106 · Native API

Stealth

T1027 · Obfuscated Files or InformationT1070.004 · File DeletionT1480 · Execution Guardrails

Discovery

T1057 · Process DiscoveryT1082 · System Information DiscoveryT1083 · File and Directory Discovery

Impact

T1486 · Data Encrypted for ImpactT1489 · Service StopT1490 · Inhibit System Recovery

Defense Impairment

T1685 · Disable or Modify Tools