Payloadbin
PayloadBIN is a ransomware strain deployed in 2021 by Evil Corp as a rebranding of their WastedLocker/Hades/Phoenix lineage, specifically designed to evade US Treasury OFAC sanctions by impersonating the unrelated Babuk gang's rebrand rather than operating as an independent group.
Victims
29
First Victim
2021-09-09
(est. attack date)
Discovery Date
2021-09-09
Last Seen
2022-01-06
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
48.0%
victims with domain
Countries
5
hit
Uptime
0.0% avg (30d)
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Payload.bin | No | 2026-08-22T08:58:43 |
vbmisqjshn4yblehk2vbnil53tlqklxsdaztgphcilto3vdj4geao5qd.onion
|
Target
Top 5 Activity Sectors
- Technology 6
- Professional Services 5
- Retail & E-Commerce 3
- Healthcare 3
- Transportation 2
Top 5 Countries
-
Australia
2
-
Switzerland
1
-
United States
1
-
Japan
1
-
Viet Nam
1
Heatmap
YARA Rules (1)
Victims (29)
