THREAT ACTOR
PAYLOAD_
ActivePAYLOAD is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of PAYLOAD, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 74
Leak site mirrors
3 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd.onionPayload | Leaks snapshot · 2026-09-23 05:17 -
payloadynyvabjacbun4uwhmxc7yvdzorycslzmnleguxjn7glahsvqd.onionPayload Rescue | Login snapshot · 2026-06-26 04:21 -
payload6eualw6kni6v2lqn7ovjcl76ojx25z5unsyvqo3lbqy3bo5qd.onionPayload Rescue snapshot · 2026-09-23 05:04
Recent victims
The 50 most recent victims claimed by PAYLOAD. Total in the index: 74.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-20 | Qualiflex Datacenter | HWZ-Studiengnge (fh-hwz.ch), myenb.ch, etc | Qualiflex Datacenter - data from companies such as HWZ-Studiengänge (f… |
| 2026-08-13 | Zara Investment Holding | Zara Investment Holding (zaraholding.com) is a leading Jordanian inves… |
| 2026-08-11 | B&B Hydraulik | B&B Hydraulik is a German company based in Hattingen that specializes … |
| 2026-08-11 | Stücheli Architekten | Stücheli Architekten is a renowned Swiss architectural firm founded in… |
| 2026-08-11 | Baya Technologies | Baya offers end-to-end solutions for complex challenges, specializing … |
| 2026-08-03 | Hans & Jos. Kronenberg GmbH | Hans & Jos. Kronenberg GmbH is a German company founded in 1932 and ba… |
| 2026-07-20 | CKR Consulting Engineers | CKR Consulting Engineers is a prominent South African engineering cons… |
| 2026-07-10 | Roofinox | Roofinox is an Austrian manufacturer of premium stainless steel specif… |
| 2026-07-09 | The commune of Castries | The commune of Castries is a picturesque, historic town in the south o… |
| 2026-07-05 | Vela Film S.r.l. | Vela Film S.r.l. is an Italian production company based in Rome, speci… |
| 2026-07-02 | Tofutown | TOFUTOWN is a traditional organic manufacturer specializing in plant-b… |
| 2026-06-26 | Mosaic Partners | The Swiss company Mosaic Partners specializes in providing IT services… |
| 2026-06-26 | Clínica La Sabana | Clínica La Sabana (clinicalasabana.com) is a medical institution locat… |
| 2026-06-26 | Software Arge | Software Arge is a leading technology company established in 2016, spe… |
| 2026-06-20 | ENB Versicherungen | myenb.ch | enb AG is an independent insurance broker that collaborates with leadi… |
| 2026-06-20 | Editora Irmãos Vitale | Editora Irmãos Vitale is a traditional Brazilian music publisher speci… |
| 2026-06-20 | Qualiflex Solutions | qualiflex.solutions | Qualiflex Solutions AG specializes in automation and control technolog… |
| 2026-06-20 | Preferred Properties | Preferred Properties, Inc. is a dynamic and progressive housing develo… |
| 2026-06-16 | SPORTON International Inc. | Founded in 1986 and headquartered in Taiwan, Sporton International is … |
| 2026-06-13 | myipo.gov.my | MyIPO provides a range of intellectual property services including pat… |
| 2026-06-08 | Plaza Lama | Plaza Lama is a retail company based in the Dominican Republic that of… |
| 2026-06-08 | Hansoll Textile in Vietnam | Hansoll Textile, established in 1992, is a global textile manufacturer… |
| 2026-06-08 | Villea Hotels in AttanaHotels | Attana Hotels & Resorts is a premier Malaysian hospitality group that … |
| 2026-05-21 | G Theodor Freese | GTF Freese is a family-owned company with over 110 years of experience… |
| 2026-05-21 | A-Sonic Logistic Solutions | Founded in 1993, A-Sonic Logistic Solutions is a supply chain manageme… |
| 2026-05-21 | Internal Medicine and Pediatrics of Cullman | Internal Medicine and Pediatrics of Cullman provides comprehensive hea… |
| 2026-05-21 | Robinsons | Founded in 1858, Robinsons established itself to become a household na… |
| 2026-05-19 | Kabushiki Gaisha Hodozuka Setsubi | hs1992.jp is the official website of Kabushiki Gaisha Hodozuka Setsubi… |
| 2026-05-19 | Tang Seng Nitrogen & Pump Systems Pte. Ltd. | Tang Seng Nitrogen & Pump Systems Pte. Ltd. is a Singapore-based engin… |
| 2026-05-19 | Elohim Law Corporation | Elohim Law Corporation is a full-service law firm based in Singapore, … |
| 2026-05-13 | Gorey Community School | Gorey Community School is a co-educational, multi-denominational insti… |
| 2026-05-13 | Inteceng.com.my (+ Tsksynergy.com.my + Amemanufacturing.com.my + Woodnova.com.my) | These websites represent a synergistic group of Malaysian companies, s… |
| 2026-04-29 | PROM (Peakside Ros Outlet Management) | PROM (Peakside Ros Outlet Management) is a joint venture established b… |
| 2026-04-26 | Rural Municipality of Gimli | The Rural Municipality of Gimli is a local government district in the … |
| 2026-04-23 | Peroni Sosa Tellechea Burt & Narvaja | PSTBN Peroni Sosa Tellechea Burt & Narvaja is one of the largest and m… |
| 2026-04-23 | meditron.com.ve | Meditron C.A. is a Venezuelan company founded in 1972, specializing in… |
| 2026-04-23 | b3-bruck.at | B3-Bruck is an Austrian company specializing in IT services and networ… |
| 2026-04-23 | caravaningcity.com | Caravaning City is a travel and lifestyle platform focused on caravann… |
| 2026-04-20 | JOH Investments Limited | JOH Investments Limited is an officially registered financial entity b… |
| 2026-04-20 | Better House | Better House Development specializes in real estate projects, offering… |
| 2026-04-20 | Al Sulaiti Law Firm | Al Sulaiti Law Firm is one of the largest law firms in Qatar, establis… |
| 2026-04-16 | Franziskusschule Wilhelmshaven | Franziskusschule Wilhelmshaven is a school located in Wilhelmshaven, a… |
| 2026-04-16 | Marino Food Products Pvt | Marino Food Products Pvt Ltd, based in Hyderabad, India, specializes i… |
| 2026-04-16 | Sunlight Express Airways | Sunlight Air offers affordable flights to popular Philippine island de… |
| 2026-04-16 | orientalweavers.com | Established in 1979, Oriental Weavers is a manufacturer of textiles us… |
| 2026-04-16 | TFE Group | TFE Group is a company that operates in the Architecture, Engineering … |
| 2026-04-08 | El Wastani Petroleum Company (WASCO) | El Wastani Petroleum Company (WASCO) is an Egyptian oil and gas compan… |
| 2026-04-03 | United Finance Egypt | United Finance Egypt is an Egyptian non-bank financial institution (NB… |
| 2026-04-03 | Tscherne Consulting Steuerberatung GmbH | Tscherne Consulting Steuerberatung GmbH is an Austrian tax consulting … |
| 2026-04-01 | SAYEGH | Sayegh 1944 presents itself as an educational company, yet its activit… |
CONFIRMED ATTACKS
Payload confirmed attacks: 7 verified incidents
Ransomnews has verified 7 Payload incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2026 to June 2026. Germany accounts for 2 of them (29%), with victims recorded in 6 countries in total. The most affected sector is service, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 6. Where a figure was disclosed (1 case), these incidents account for 156 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Payload incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2026 | Sporton International Inc. | Service | New Taipei City, Taiwan | — | Unknown | Source |
| May 2026 | GTF Freese (G. Theodor Freese GmbH) | Manufacturing | Bremen, Germany | — | Unknown | Source |
| April 2026 | JOH Investments Limited | Finance | Kingston, Jamaica | — | Unknown | Source |
| April 2026 | Rural Municipality of Gimli | Government | Gimli, Canada | — | Unknown | Source |
| April 2026 | B3 Bruck an der Mur | Education | Bruck, Austria | — | No | Source |
| April 2026 | Franziskusschule Wilhelmshaven | Education | Wilhelmshaven, Germany | — | Unknown | Source |
| March 2026 | Carlysle Engineering, Inc. | Service | Massachusetts, United States | 156 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Payload's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.