Skip to main content
Darkfield

Operator dossier

Payloadbin is a ransomware operator currently active on public leak sites. Darkfield has indexed 48 public victims claimed by this operator between September 9, 2021 and March 26, 2026. Payloadbin is a relatively obscure ransomware group that emerged in September 2021, primarily motivated by financial gain through extortion operations targeting diverse sectors across multiple countries. The group's origin and potential affiliations remain largely undocumented in public threat intelligence reporting, with limited information available regarding whether they operate as an independent entity or utilize a Ransomware-as-a-Service model. Based on observed victim patterns, Payloadbin has demonstrated a broad targeting approach without apparent sector specialization, though they have notably impacted healthcare, manufacturing, agriculture and food production, and telecommunications organizations across 48 documented cases. Their attack methodology and specific technical capabilities have not been extensively documented by major security research organizations, though their operational pattern suggests standard ransomware deployment tactics. The group has primarily targeted victims in the United States, Philippines, Australia, Mexico, and the United Kingdom, indicating either a broad opportunistic approach or potential linguistic capabilities spanning English-speaking regions and select international markets. No major high-profile campaigns, significant law enforcement disruptions, or notable ransomware payment records have been publicly attributed to this group by federal agencies or established threat intelligence firms. Current operational status remains unclear due to limited public documentation, though the group's relatively recent emergence and modest victim count suggests they may represent a smaller-scale operation compared to prominent ransomware families tracked by CISA and FBI reporting.

Most-targeted sectors

Most-affected countries

Recent disclosures by Payloadbin

All 48 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Payloadbin →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Payloadbin

48 victims indexed · first seen 5 years ago · last activity 4 months ago

48
Victims indexed
#109 of 364 tracked operators
4y 6m
Active period
Sep 2021 → Mar 2026
10
Countries hit
top United States · 4

At a glance

Status
active
First seen
5 years ago
Last activity
4 months ago
Onion sites
2 known endpoints
Primary sector
Not Found · 10 hits

About

Payloadbin is a relatively obscure ransomware group that emerged in September 2021, primarily motivated by financial gain through extortion operations targeting diverse sectors across multiple countries. The group's origin and potential affiliations remain largely undocumented in public threat intelligence reporting, with limited information available regarding whether they operate as an independent entity or utilize a Ransomware-as-a-Service model. Based on observed victim patterns, Payloadbin has demonstrated a broad targeting approach without apparent sector specialization, though they have notably impacted healthcare, manufacturing, agriculture and food production, and telecommunications organizations across 48 documented cases. Their attack methodology and specific technical capabilities have not been extensively documented by major security research organizations, though their operational pattern suggests standard ransomware deployment tactics. The group has primarily targeted victims in the United States, Philippines, Australia, Mexico, and the United Kingdom, indicating either a broad opportunistic approach or potential linguistic capabilities spanning English-speaking regions and select international markets. No major high-profile campaigns, significant law enforcement disruptions, or notable ransomware payment records have been publicly attributed to this group by federal agencies or established threat intelligence firms. Current operational status remains unclear due to limited public documentation, though the group's relatively recent emergence and modest victim count suggests they may represent a smaller-scale operation compared to prominent ransomware families tracked by CISA and FBI reporting.

References

3 links

External sources curated by the MISP threat-intel community.

Timeline

6 months
2021-09-01T00:00:00+00:00 · 232021-10-01T00:00:00+00:00 · 22021-12-01T00:00:00+00:00 · 12022-01-01T00:00:00+00:00 · 32026-02-01T00:00:00+00:00 · 22026-03-01T00:00:00+00:00 · 17
2021-09-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
4
🇵🇭 Philippines
3
🇦🇺 Australia
2
🇲🇽 Mexico
2
🇬🇧 United Kingdom
2
🇯🇵 Japan
1
🇨🇭 Switzerland
1
🇪🇸 Spain
1
United States dossier →Philippines dossier →Australia dossier →Mexico dossier →

Top sectors

Healthcare
2
Manufacturing
2
Agriculture and Food Production
2
Telecommunication
1
Financial Services
1
Energy
1
Transportation/Logistics
1
Healthcare dossier →Manufacturing dossier →Agriculture and Food Production dossier →Telecommunication dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://vbmisqjshn4yblehk2vbnil53tlqklxsdaztgphcilto3vdj4geao5qd.onion
  • http://vbmisqjshn4yblehk2vbnil53tlqklxsdaztgphcilto3vdj4geao5qd.onion/

Source

Updated 4 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Payloadbin posts a victim.

Add Payloadbin to your watchlist — Pro pings you within 5 minutes of any new Payloadbin leak-site post, Telegram callout, or affiliate-rebrand inference.