Payload Ransomware Claims to Have Stolen 110 GB From Royal Bahrain Hospital
Summary
Payload Ransomware claims it stole 110 GB from Royal Bahrain Hospital and threatens to publish the data unless a ransom is paid by March 23. The article attributes the claim to the group’s Tor leak site; the incident is unconfirmed.
Key points
- Payload Ransomware claims it hacked Royal Bahrain Hospital and stole 110 GB of data; the article does not independently confirm the claim.
- The group reportedly listed the hospital on its Tor leak site and posted images of allegedly compromised systems.
- Payload threatens to publish the data if a ransom is not paid by March 23; the article gives no year for the deadline.
- The article describes Payload as using double extortion, with ChaCha20 encryption, Curve25519 key exchange, shadow-copy deletion, and disabling security tools.
- The article says Payload likely operates as ransomware-as-a-service; this is presented as an assessment, not a confirmed fact.
Article Details
- Victim
- Royal Bahrain Hospital
- Encryption Status
- Unknown; the article describes Payload's general encryption capabilities but does not confirm encryption of the hospital's systems.
- Exfiltration Status
- Claimed by Payload Ransomware; not independently confirmed.
- Exfiltrated Data
- 110 GB of unspecified data, according to the group's claim.
- Exfiltrated Size
- 110 GB, according to the group's claim.
- Ransom Demand
- The group threatened to release the data unless a ransom was paid by March 23; the amount was not disclosed.
- Leak Status
- The hospital was added to the group's Tor leak site, where images of allegedly compromised systems were posted as proof. The article does not report publication of the claimed 110 GB.
MITRE ATT&CK
T1486 · Data Encrypted for ImpactThe article says Payload ransomware uses file encryption as part of its general double-extortion operation; use against the hospital is not confirmed.T1490 · Inhibit System RecoveryThe article says Payload ransomware deletes shadow copies as a general capability; use against the hospital is not confirmed.T1562.001 · Disable or Modify ToolsThe article says Payload ransomware disables security tools as a general capability; use against the hospital is not confirmed.