Payload
Payload is a ransomware group with a financial motive, tracked by Brandefense. It targets 13 sectors, including Government and Technology, in 20 countries, including the United States and France. It uses 6 MITRE ATT&CK techniques.
- Techniques
- 6
- Exploited CVEs
- No CVE data
- First seen
- Feb 17, 2026
- Last seen
- Aug 20, 2026
- Record updated
Who They Target.
Sectors · 13
Countries · 20
About Payload.
Payload is a ransomware group that emerged in early 2026, using Babuk-derived source code targeting both Windows and ESXi systems with cross-platform double-extortion attacks against healthcare, energy, real estate, and agriculture sectors, claiming 12 victims across seven countries within hours of launching its leak site.
Last updated Oct 7, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.