Payload ransomware uses ChaCha20 and Curve25519 to lock Windows files

Payload ransomware is an emerging Windows-focused threat that uses ChaCha20 encryption and Curve25519 key exchange to lock victim files. Security researchers say the malware appends the .payload extension, drops a RECOVER_payload.txt ransom note, and uses anti-forensics features to make recovery harder.

The ransomware appeared in February 2026 and quickly drew attention because of its technical design. A SOC Prime analysis describes Payload as a Windows ransomware family that combines per-file Curve25519 ECDH key exchange with ChaCha20 encryption.

The threat also targets recovery options before encryption starts. It deletes shadow copies, clears Windows Event Logs, patches Event Tracing for Windows functions, and stops processes linked to databases, backup tools, and office applications.

Why Payload ransomware stands out

Many ransomware families use hybrid encryption, but Payload’s implementation gives defenders little room for easy recovery. The Windows variant generates a fresh key setup for each file, then stores recovery metadata in an encrypted footer.

RansomLook’s Windows technical analysis says the malware uses optimized ChaCha20 routines, Curve25519 key exchange, IOCP-based multithreaded file processing, ETW patching, and self-deletion through NTFS alternate data streams.

The ransomware also creates a mutex named MakeAmericaGreatAgain to prevent multiple copies from running on the same host. That single-instance check helps the malware avoid conflicts while encryption runs.

Key details at a glance

Item	Details
Threat name	Payload ransomware
First observed	February 2026
Primary platform	Windows, with separate Linux and ESXi activity reported
File extension	.payload
Ransom note	RECOVER_payload.txt
Encryption	ChaCha20 with Curve25519 ECDH key exchange
Mutex	MakeAmericaGreatAgain
Notable behavior	Shadow copy deletion, ETW patching, event log clearing, and service termination

How Payload encrypts files

Payload uses a per-file encryption workflow. For each file, researchers say the malware generates new cryptographic material, derives a shared secret through Curve25519, and uses that value as the ChaCha20 key.

The SOC Prime report says the malware writes a 56-byte encrypted footer at the end of each processed file. That footer contains data needed by the operator to recover the file with the corresponding private key.

This design makes free decryption unlikely unless defenders obtain the attackers’ private keys, find an implementation weakness, or recover unaffected backups. The malware’s use of Windows cryptographic functions and optimized CPU paths also helps it run quickly on modern systems.

Payload targets recovery before encryption begins

Payload does not rely only on encryption. It prepares the system first by weakening recovery and logging options. That behavior can leave incident responders with fewer artifacts after the attack.

Malpedia’s Payload entry says the Windows variant deletes recovery points, stops selected services and processes, wipes or bypasses logging mechanisms, and can hide or remove its own executable while encryption continues.

The malware also targets shadow copies with vssadmin.exe. If attackers delete those snapshots successfully, organizations cannot depend on built-in Windows restore points to recover files.

Victim activity and target profile

Payload uses a double-extortion model. The operators maintain Tor-based infrastructure for data leak publication and negotiations, then pressure victims with deadlines and threatened publication.

Halcyon’s threat actor profile says Payload surfaced on February 17, 2026, when a compiled Windows binary and the first leak site posting appeared within hours. The company describes Payload as a closed group with no confirmed ties to named ransomware ecosystems.

Reported targets include manufacturing, business services, healthcare, logistics, real estate, retail, and other sectors where downtime can create immediate financial pressure. Victim counts vary by tracker, so organizations should focus on the group’s active status and technical behavior rather than one static number.

Windows and ESXi activity expands the risk

Although the current technical focus is the Windows encryptor, Payload is not limited to standard Windows endpoints. Researchers have also described Linux and VMware ESXi variants, which increases the risk for virtualized environments.

Malpedia describes Payload as a cross-platform ransomware family with native Windows and Linux/ESXi binaries. It notes that the Linux/ESXi variant focuses on locating and encrypting virtual machine disk files.

This matters because ESXi hosts can contain several business-critical virtual machines on one system. A successful attack on that layer can disrupt many workloads at once.

Indicators defenders should monitor

Security teams should watch for a combination of file, process, and system-level indicators. No single indicator guarantees compromise, but several together should trigger urgent investigation.

Indicator type	Indicator
SHA-256 sample hash	1CA67AF90400EE6CBBD42175293274A0F5DC05315096CB2E214E4BFE12FFB71F
File extension	.payload
Ransom note	RECOVER_payload.txt
Mutex	MakeAmericaGreatAgain
Log file	\??\C:\payload.log
Shadow copy command	vssadmin.exe delete shadows /all /quiet

Anti-forensics make response harder

Payload’s anti-forensics behavior deserves close attention. ETW patching can reduce visibility into malicious actions, while event log clearing can erase evidence that investigators need after encryption begins.

The RansomLook analysis also documents the Windows sample’s use of native NT APIs resolved at runtime. That approach can help malware avoid security tools that mainly monitor higher-level Windows API calls.

These techniques do not make detection impossible. They do mean defenders need layered controls, endpoint telemetry, protected logging, and backup monitoring that does not depend only on local Windows artifacts.

How organizations can reduce the risk

Organizations should prioritize backup resilience. Offline or immutable backups remain one of the strongest defenses against ransomware that deletes shadow copies and attacks backup services.

CISA’s StopRansomware guidance recommends tested backups, updated systems, phishing-resistant MFA, network segmentation, and incident response planning as core ransomware defenses.

• Maintain offline or immutable backups and test restoration regularly.
• Restrict unnecessary use of vssadmin.exe and monitor shadow copy deletion commands.
• Alert on RECOVER_payload.txt, .payload extensions, and the Payload mutex.
• Monitor sudden shutdown of database, backup, and security services.
• Protect Windows Event Logs and forward logs to a separate system.
• Segment backup servers, hypervisors, and critical file shares.
• Use endpoint controls that detect ETW tampering and suspicious NT API activity.

What to do if Payload is detected

If Payload activity appears in an environment, security teams should isolate affected hosts immediately. Fast containment can stop encryption from spreading to network shares or adjacent systems.

After isolation, responders should preserve volatile data, collect available logs, identify stopped services, and confirm whether backups remain clean. CISA also advises organizations to report ransomware incidents and avoid actions that destroy evidence before responders can investigate.

Teams should not assume Windows shadow copies survived. Payload specifically targets that recovery path, so restoration plans should depend on backup systems that attackers cannot easily reach from compromised endpoints.

The bigger picture

Payload shows how quickly new ransomware crews can combine proven codebases with modern anti-forensics. The group’s reported Babuk-derived roots do not make it simple or outdated.

Halcyon says the Payload group shows no confirmed ties to named ransomware ecosystems, and describes the Babuk connection as source-code derivation rather than proof of direct affiliation.

CYFIRMA’s March threat report also identified Payload as ransomware of the week and noted its focus on Windows, real estate, retail, Mexico, and Egypt. Its researchers highlighted shadow copy deletion, event log clearing, monitoring bypass, and service termination before encryption.

For defenders, the message is clear. Payload should be treated as an active ransomware threat with strong encryption, fast execution, and aggressive efforts to break recovery. Detection, segmentation, and clean backups matter more than hoping for a public decryptor.

The CYFIRMA report also links the malware to common MITRE ATT&CK techniques such as command execution, native API use, service manipulation, and process injection. Those behaviors give security teams several detection opportunities before encryption finishes.

FAQ