payload

payload Ransomware operates an extortion-based campaign that encrypts files using ChaCha20 with Curve25519 ECDH and appends the .payload extension, and it has employed Babuk-style cryptography alongside advanced anti-forensic techniques, including targeting Windows and VMware ESXi systems. Approximately 70 victims have been claimed, with the most affected sectors being manufacturing, financial services, agriculture and food production, business services, and consumer services, and the countries hit most often are CH, US, DE, SG, and EG. Recent reporting shows a pattern of rapid expansion and data-extortion activity; for example, the group claimed responsibility for breaching Royal Bahrain Hospital, exfiltrating 110 GB of data and publishing images on its Tor data leak site.

Sectors: Manufacturing, Hospitality and Tourism, Agriculture and Food Production · Countries: CH, US, DE