Payload 2026 activity
Ransomware group. 6 reports in 5 countries: 0 confirmed, 6 claimed or disputed. Latest 13 Jun 2026.
Malaysia · 
Vietnam · 
Ireland · 
Egypt · 
Thailand
🎯 What sources say
- Malaysia: Listed MyIPO (myipo.gov.my) in June 2026 plus Villea Hotels and a group of manufacturing domains in May. ransomware.live
- Philippines: Listed four Philippine firms in March and April, including TS Lines Philippines and Sunlight Express Airways. Ransomware.live (Philippines)
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ⚠️ ClaimedIntellectual Property Corporation of Malaysia (MyIPO)Kuala Lumpur | Malaysia | 13 Jun 2026 | Government | Ransomware | Payload | Claimed. Payload listed myipo.gov.my on its leak site. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedHansoll Textile (Vietnam) | Vietnam | 8 Jun 2026 | Manufacturing | Ransomware | Payload | Claimed. Payload listed Hansoll Textile's Vietnam operation on its leak site on 8 June 2026. | ransomware.live✓ 7 Nov |
| ⚠️ ClaimedGorey Community School | Ireland | 13 May 2026 | Education | Ransomware | Payload | Claimed. Payload listed the Wexford school on its leak site and threatened to publish data. No school statement found. | DeXpose✓ 8 Nov |
 ⚠️ ClaimedUnited Finance Egypt | Egypt | 3 Apr 2026 | Finance | Ransomware | Payload | Claimed. Payload claimed access to the lender's whole infrastructure and said most of the data is customer information. | DeXpose · ransomware.live✓ 8 Nov |
 ⚠️ ClaimedThai Solar Energy PCL | Thailand | 14 Mar 2026 | Energy | Ransomware | Payload | Claimed. Payload listed Thai Solar Energy on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedSODIC | Egypt | 17 Feb 2026 | Property | Ransomware | Payload | Claimed. Payload listed the real estate developer and said the full leak would follow unless the company made contact. | DeXpose · ransomware.live✓ 8 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology