Payload Ransomware Targeting Windows and VMware ESXi with Babuk-Derived Curve25519/ChaCha20 Encryption — Threadlinqs Intelligence
As of 2026-05-30, Payload Ransomware Targeting Windows and VMware ESXi with Babuk-Derived Curve25519/ChaCha20 Encryption is a high-severity ransomware threat attributed to Payload Ransomware Group (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-0340 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: Payload Ransomware Group · Russia · FINANCIAL
Payload is a new ransomware operation active since February 2026, combining Babuk-derived Curve25519 ECDH key exchange with ChaCha20 symmetric encryption to target both Windows and Linux/ESXi
Payload is a ransomware family that emerged in February 2026, built upon the leaked Babuk ransomware source code from September 2021. The developer replaced the original HC-128 cipher with ChaCha20 and added significant anti-forensic capabilities absent from the original Babuk codebase, creating a distinct and more operationally sophisticated variant.
The Windows binary (~395 KB, compiled 2026-02-17 08:39:07 UTC) implements a hybrid encryption scheme using Curve25519 ECDH (curve25519-donna library) for asymmetric key exchange and ChaCha20 for symmetric file encryption. For each file, the malware generates a random 32-byte private key and 12-byte nonce via CryptGenRandom, computes a Curve25519 shared secret with the operator's embedded public key, and uses this shared secret directly as the ChaCha20 encryption key. Files are encrypted in 1 MB chunks, with files exceeding 2 GB receiving only 20% partial encryption across evenly-spaced 1 MB blocks for performance optimization. After encryption, per-file keys are securely zeroed from memory. An 8-byte footer marker "payload\0" is appended to each encrypted file, and the footer itself is encrypted with RC4 using the 3-byte key "FBI". Encrypted files receive the .payload extension.
The ransomware deploys extensive anti-forensic measures. ETW (Event Tracing for Windows) is neutralized by patching four functions — EtwEventWrite, EtwEventWriteFull, EtwEventWriteTransfer, and EtwRegister — with return-zero stubs (48 33 C0 C3 for WoW64, 33 C0 C2 14 00 for x86), effectively blinding EDR telemetry. All Windows event log channels are enumerated via EvtOpenChannelEnum and cleared using EvtClearLog. Shadow copies are deleted via "vssadmin.exe delete shadows /all /quiet". The Recycle Bin is emptied using the SHEmptyRecycleBinA API. For self-deletion, the malware renames its own executable to an NTFS Alternate Data Stream (":payload"), marks the file for deletion on handle close, leaving minimal forensic artifacts.
The malware terminates 31 processes (including sql.exe, oracle.exe, excel.exe, winword.exe, outlook.exe, firefox.exe, thunderbird.exe) and stops 34 services (including Veeam, Acronis, BackupExec, YooBackup, Symantec, Sophos, Qihoo 360, and QuickBooks) to maximize encryption coverage of database files, documents, and backups. It supports granular command-line arguments: m (disable mutex), n (disable ransom note), d (disable self-deletion), k (disable process kill), s (skip network shares), l (enable event log deletion), i (ignore filters), bypass-etw, background, algo (encryption path selection), and threads (thread count).
The ransom note (RECOVER_payload.txt or RECOVERY-xx0001.txt) is stored RC4-encrypted in the .rdata section using the key "hQEPINuTY2lytufLDpJQdVkrWlovC1QR" and decrypted at runtime. It presents a 72-hour initial deadline and a 240-hour negotiation window, offering up to 3 free file decryptions (15 MB each) as proof of capability. A debug log is written to C:\payload.log during execution.
The Linux/ESXi variant is a compact ~40 KB ELF binary that specifically targets VMware infrastructure by parsing /etc/vmware/hostd/vmInventory.xml using libxml2 to enumerate virtual machines. It uses /dev/urandom for random number generation and implements a thread pool via C-based thpool with prctl naming. Anti-debugging is achieved by checking the TracerPid field in /proc/self/status. Notably, the ESXi build uses a different operator Curve25519 public key than the Windows variant, suggesting compartmentalized operations or separate affiliate keys.
The Payload group operates a double-extortion model with two Tor hidden services: a negotiation portal and a data leak blog. The ransomware operates in an offline model with no direct C2 communication — all victim interaction occurs through the Tor portal. As of mid-March 2026, the group has claimed 12 victims across 7 countries totaling 2,603 GB of exfiltrated data, targeting healthcare (Royal Bahrain Hospital, 110 GB), telecommu
Target sectors: healthcare, telecommunications, energy, real-estate, agriculture, retail
Target regions: Middle East, Latin America, Africa, South Asia, Southeast Asia
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1059, T1106, T1129, T1562, T1562, T1070, T1070, T1027, T1140, T1497