Payload Ransomware Encrypts Windows Files with ChaCha20 and Curve25519

Key Takeaways

• A sophisticated new ransomware strain, dubbed Payload, has been actively targeting Windows systems globally since February 2026.
• Payload employs advanced encryption techniques, specifically ChaCha20 and Curve25519 ECDH, making file recovery without the attackers’ private key virtually impossible.
• The ransomware utilizes aggressive anti-forensics methods, including deleting shadow copies, clearing event logs, and patching event-tracing functions, to hinder detection and incident response.
• Victims, primarily in industries sensitive to downtime like logistics, manufacturing, and real estate, are given 240 hours to initiate ransom negotiations.

Payload Ransomware: A New Global Threat to Windows Systems

A formidable new ransomware operation, identified as Payload, has been observed actively compromising Windows systems worldwide since its emergence in February 2026. This group has rapidly expanded its victim base, establishing a leak site that, by March 24, 2026, already listed 50 organizations across diverse sectors including real estate, logistics, manufacturing, and technology providers.

Initial targets included a high-profile entity, and the group’s operations have since spread geographically, affecting entities in Egypt, Mexico, Poland, and other regions. What distinguishes Payload ransomware is not merely its international reach but the advanced technical sophistication embedded in its encryption mechanisms and evasion tactics.

Technical Sophistication in Encryption

Payload ransomware is engineered to target Windows environments, encrypting files and appending the “.payload” extension to each compromised item. Victims discover a ransom note titled RECOVER_payload.txt, which specifies a 240-hour window for initiating negotiations.

According to an in-depth technical analysis conducted by Dark Atlas and shared with Cyber Security News (CSN), the Payload group demonstrates significant technical maturity. Their encryption engine is well-designed, and the ransomware incorporates robust measures to thwart detection.

The malware employs a per-file encryption strategy, rendering recovery without the attackers’ private key nearly impossible. For every file, Payload generates a unique 32-byte private key and a 12-byte nonce using the Windows CryptGenRandom function. It then executes a Curve25519 Elliptic Curve Diffie-Hellman (ECDH) operation, combining the victim’s temporary key with the operator’s embedded public key to derive a shared secret. This shared secret is directly utilized as the ChaCha20 key for file encryption.

Files are encrypted in one-megabyte segments. Upon completion, a 56-byte footer is appended to each encrypted file. This footer contains the victim’s temporary public key and the nonce, which are further obfuscated using RC4 encryption with the three-byte key “FBI.” This design ensures that while the operator can decrypt any file using their private key, victims are left without a viable path to decryption independently.

The ransomware also optimizes its encryption speed by supporting three modes (AVX2, SSE2, and a standard scalar path), automatically selecting the most efficient option based on the victim’s processor. Furthermore, it leverages direct Windows NT API calls instead of standard user-mode functions, a technique that helps it bypass security tools monitoring higher-level system activities.

Anti-Forensics and Evasion Techniques

A particularly concerning aspect of Payload ransomware is its aggressive approach to anti-forensics and evasion. The malware implements several steps to eliminate traces and prevent recovery:

• It uses a mutex named “MakeAmericaGreatAgain” to ensure only a single instance runs on a machine.
• Before encryption, it deletes all Windows shadow copies, severely limiting recovery options.
• When the “bypass-etw” flag is active, Payload patches four critical event-tracing functions within Windows’ ntdll library. This action effectively silences the operating system’s ability to log the ransomware’s activities, leaving minimal forensic evidence.
• The ransomware dynamically loads the Windows event log API at runtime and clears all available channels, including Application, System, and Security logs, further hindering post-incident analysis.
• To ensure uninterrupted encryption, Payload terminates over 30 processes and stops more than 40 services. These targeted services include critical applications like SQL databases and backup solutions such as Veeam and Acronis.

The Payload ransomware group primarily targets industries where operational downtime translates into immediate financial pressure. Logistics, transportation, construction, and real estate firms, particularly in the Middle East and North Africa (MENA) region, are prominent on its victim list.

Security researchers emphasize the importance of closely monitoring Payload as an evolving international ransomware threat. Tracking its leak site, victimology patterns, and any changes in its codebase will be crucial for understanding its trajectory and developing effective countermeasures.

What You Should Do

• Monitor for Indicators of Compromise (IoCs): Actively look for the presence of RECOVER_payload.txt, files with the “.payload” extension, and the log file at ??C:payload.log.
• Detect Process Termination: Implement monitoring for sudden or unusual termination of backup, database, and office services, as this is a strong indicator of active ransomware deployment.
• Maintain Offline Backups: Ensure critical data is regularly backed up to offline, immutable storage that is inaccessible from the network. This is the most reliable defense against ransomware data loss.
• Protect Shadow Copy Services: Implement robust controls and protections for Volume Shadow Copy Service (VSS) at the infrastructure level to prevent their deletion by malware.
• Implement Endpoint Detection and Response (EDR): Utilize EDR solutions capable of detecting and blocking malicious behavior, including API hooking, process termination, and unusual file modifications.
• Employee Training: Educate employees on recognizing and reporting phishing attempts and suspicious emails, which are common initial access vectors for ransomware.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.