payloadbin
First seen September 9, 2021Active29 claimed victims
The claims below are reproduced as posted by payloadbin on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
PayloadBIN is a ransomware strain deployed in 2021 by Evil Corp as a rebranding of their WastedLocker/Hades/Phoenix lineage, specifically designed to evade US Treasury OFAC sanctions by impersonating the unrelated Babuk gang's rebrand rather than operating as an independent group.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| aquila.ch | January 6, 2022 | ransomware_live | — |
| Serenity Homes SWFL | January 1, 2022 | ransomware_live | — |
| www.paw.eu | January 1, 2022 | ransomware_live | — |
| www.hillsdalefurniture.com | December 23, 2021 | ransomware_live | — |
| dawsoncountyne.org | October 19, 2021 | ransomware_live | — |
| www.lockslaw.com | October 16, 2021 | ransomware_live | — |
| calsoft.com | September 30, 2021 | ransomware_live | — |
| calsoft | September 30, 2021 | ransomware_live | — |
| calautomotive.com | September 30, 2021 | ransomware_live | — |
| www.myyp.com | September 25, 2021 | ransomware_live | — |
| www.webstercare.com.au | September 9, 2021 | ransomware_live | — |
| Wrgtexas.com | September 9, 2021 | ransomware_live | — |
| Connelypartners.com | September 9, 2021 | ransomware_live | — |
| Truckcentercompanies.com | September 9, 2021 | ransomware_live | — |
| Uptownbakers.com | September 9, 2021 | ransomware_live | — |
| Victrongroup.com | September 9, 2021 | ransomware_live | — |
| CD Project data | September 9, 2021 | ransomware_live | — |
| iRely LLC's Grand Failure | September 9, 2021 | ransomware_live | — |
| nsuship.co.jp | September 9, 2021 | ransomware_live | — |
| sklarwilton.com | September 9, 2021 | ransomware_live | — |
| conferenceusa.com | September 9, 2021 | ransomware_live | — |
| pdsec.com | September 9, 2021 | ransomware_live | — |
| www.emmawillard.org | September 9, 2021 | ransomware_live | — |
| www.coreslab.com | September 9, 2021 | ransomware_live | — |
| www.crm.com | September 9, 2021 | ransomware_live | — |
| webstercare.com.au | September 9, 2021 | ransomware_live | — |
| neuro-logica.com | September 9, 2021 | ransomware_live | — |
| Capstoneins.com | September 9, 2021 | ransomware_live | — |
| Reconservices.com | September 9, 2021 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).