PayloadBIN is a ransomware group that emerged in June 2021, primarily operating as a rebranding effort by the established cybercrime group Evil Corp. This strategic shift was undertaken to circumvent US sanctions previously imposed on Evil Corp, which is also known by the aliases Indrik Spider and the Dridex gang. PayloadBIN achieved this by impersonating the Babuk ransomware group, whose data leak site had undergone a redesign around the same period. The group's core motivation is financial gain through cyber extortion, employing double extortion tactics. Their distinctiveness lies in this calculated impersonation strategy, which allowed Evil Corp to continue its ransomware operations, previously conducted under names such as WastedLocker, Hades, and Phoenix, while attempting to evade detection and sanctions.

Paises afectados

URLs nuevas detectadas en IntelTracker