Payload

☆ pin

Also known as PAYLOAD

Reports

First seen

May 13, 2026

Last seen

Oct 8, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×7 Media & Entertainment ×3 Government ×2 Healthcare ×2 Financial Services ×2 Other ×2 Professional Services ×2 Transport & Logistics ×1

Victim regions

×1

×4

Switzerland×4

Germany×3

United States×2

Malaysia×2

France×1

Brazil×1

Vietnam×1

Ireland×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1078 Valid Accounts ×5T1110 Brute Force ×3T1555 Credentials from Password Stores ×2T1021 Remote Services ×2T1087 Account Discovery ×2T1098 Account Manipulation ×2T1133 External Remote Services ×2T1486 Data Encrypted for Impact ×2T1136 Create Account ×2T1070.001 Clear Windows Event Logs ×2T1490 Inhibit System Recovery ×1T1059 Command and Scripting Interpreter ×1

Indicators

domain ×50cve ×35ip_v4 ×12registry_key ×6filename ×4hash_md5 ×3hash_sha256 ×3

Indicator values are available on Pro and via the API.

Recent reports

High

Payload

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Payload ransomware gang publishes Boullard Musique as victim

FBI warns FortiBleed attacks continue targeting exposed FortiGate VPN admins

FBI, Secret Service warn of FortiBleed credential stealing campaign affecting 86,000+ firewalls

FortiBleed: Active credential compromise campaign targeting Fortinet devices

Payload ransomware gang publishes Netech (Neeser Technik AG) as victim

PAYLOAD ransomware weaponizes Active Directory GPO for domain-wide disruption without file encryption

Payload ransomware gang publishes Qualiflex Datacenter and Swiss company data

Payload ransomware gang publishes Zara Investment Holding as victim

Payload ransomware gang publishes B&B Hydraulik as victim

Payload ransomware gang publishes Stücheli Architekten as victim

Payload ransomware gang publishes Baya Technologies as victim

Payload Ransomware Gang Claims Hans & Jos. Kronenberg GmbH Breach

Payload ransomware group claims new victim: CKR Consulting Engineers

Payload ransomware gang publishes Roofinox as victim

Payload ransomware gang claims compromise of French commune of Castries

Payload ransomware gang publishes ENB Versich as victim

Payload ransomware gang claims new victim: Vela Film S.r.l.

Payload ransomware gang claims new victim: Tofutown

Payload ransomware gang publishes Villea Hotels as victim

Payload ransomware gang publishes Clínica La Sabana as victim

Payload ransomware gang publishes Software Arge as victim

Payload ransomware gang publishes Mosaic Partners as victim

Payload ransomware gang claims ENB Versicherungen victim

Payload ransomware gang publishes Editora Irmãos Vitale as victim

Payload ransomware gang claims Qualiflex Solutions victim

Payload ransomware gang claims Preferred Properties as new victim

Payload ransomware claims SPORTON International Inc. as victim

Payload ransomware gang publishes myipo.gov.my as victim

Payload ransomware gang claims Plaza Lama as victim

Payload ransomware gang claims Hansoll Textile victim in Vietnam