{
	"id": "185aa094-64ff-432c-8a7a-b0a5f73e34d0",
	"created_at": "2026-04-23T02:53:55.233Z",
	"updated_at": "2026-04-25T02:18:42.697605Z",
	"deleted_at": null,
	"sha1_hash": "5ec26ce2148f04b62d1cdddf4bb9458ebfdad598",
	"title": "Babuk re-organizes as Payload Bin, offers its first leak - DataBreaches.Net",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 182850,
	"plain_text": "Babuk re-organizes as Payload Bin, offers its first leak -\r\nDataBreaches.Net\r\nPublished: 2021-06-01 · Archived: 2026-04-23 02:32:32 UTC\r\nAt the end of April, threat actors known as Babuk indicated that they were closing up shop and switching to a\r\ndifferent model:\r\nBabuk changes direction, we no longer encrypt information on networks, we will get to you and take\r\nyour data, we will notify you about it if you do not get in touch we make an announcement.\r\nAlso for other groups that do not have their own blog or have but they want to exert additional pressure,\r\nyou can not be placed with us.\r\nTwo weeks later, they wrote:\r\nHello! We announce the development of something really cool, a huge platform for independent leaks,\r\nwe have no rules and bosses, we will publish private products in a single information platform where\r\nwe will post leaks of successful no-name teams that do not have their own blogs and names, these are\r\nnot girls who run with ship like rats and change the policy of their resources. these are really strong\r\nguys.\r\nAnother loud leak awaits you within a week.\r\nToday, we began to see the changes as the site is now called Payload Bin.\r\nhttps://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/\r\nPage 1 of 3\n\nImage: DataBreaches.net\r\nThe About and Rules pages are not available yet and so far there is only one leak listed under Announcements: \r\nCD Projekt. CD Projekt was attacked in February by attackers using what is believed to be the Hello Kitty\r\nransomware. The hackers had put the stolen source code up for sale on a Russian-language forum, listing it all as:\r\nFull sources for the games Thronebreaker , Witcher 3 , the undeclared Witcher 3 RTX (the version of\r\nthe Witcher with raytracing) and of course Cyberpunk 2077\r\nDumps of internal documents\r\nCD Projekt RED offenses .\r\nThey subsequently withdrew the auction listing, claiming that they had received a satisfactory offer from outside\r\nof the forum, and that because of a condition of no further distribution, they were removing the listing from\r\nauction.\r\nSource code withdrawn from auction. Image: DataBreaches.net\r\nNow Payload Bin says they will make all source code available on its site. So what, exactly, happened to that sale\r\nwith “no further distribution?”\r\nhttps://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/\r\nPage 2 of 3\n\nImage: DataBreaches.net\r\nSource: https://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/\r\nhttps://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/"
	],
	"report_names": [
		"babuk-re-organizes-as-payload-bin-offers-its-first-leak"
	],
	"threat_actors": [],
	"ts_created_at": 1776912835,
	"ts_updated_at": 1777083522,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/5ec26ce2148f04b62d1cdddf4bb9458ebfdad598.pdf",
		"text": "https://archive.orkl.eu/5ec26ce2148f04b62d1cdddf4bb9458ebfdad598.txt",
		"img": "https://archive.orkl.eu/5ec26ce2148f04b62d1cdddf4bb9458ebfdad598.jpg"
	}
}