Payload Ransomware Targeting Windows and VMware ESXi with Babuk-Derived Curve25519/ChaCha20 Encryption
Payload Ransomware Targeting Windows and VMware ESXi with (TL-2026-0340), also tracked as Payload Ransomware, is a high-severity ransomware operation, first published 2026-04-09. It is attributed to Payload Ransomware Group (Russia) with low confidence, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0340
- Threat ID
- TL-2026-0340
- Also known as
- Payload Ransomware, Babuk-Payload
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-04-09
- Last reviewed
- 2026-04-09
- Attribution
- Payload Ransomware Group
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- healthcare, telecommunications, energy, real-estate, agriculture, retail
- Target regions
- Middle East, Latin America, Africa, South Asia, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Payload Ransomware Targeting Windows and VMware ESXi with
Malware and tooling: payload
Payload is a new ransomware operation active since February 2026, combining Babuk-derived Curve25519 ECDH key exchange with ChaCha20 symmetric encryption to target both Windows and Linux/ESXi environments. Operating a double-extortion model via Tor leak sites, the group has claimed 12 victims across 7 countries with 2.6 TB of exfiltrated data, employing advanced anti-forensics including ETW function patching, Windows event log wiping, shadow copy deletion, and NTFS Alternate Data Stream self-deletion.
How Payload Ransomware Targeting Windows and VMware ESXi with works
Payload is a ransomware family that emerged in February 2026, built upon the leaked Babuk ransomware source code from September 2021. The developer replaced the original HC-128 cipher with ChaCha20 and added significant anti-forensic capabilities absent from the original Babuk codebase, creating a distinct and more operationally sophisticated variant.
The Windows binary (~395 KB, compiled 2026-02-17 08:39:07 UTC) implements a hybrid encryption scheme using Curve25519 ECDH (curve25519-donna library) for asymmetric key exchange and ChaCha20 for symmetric file encryption. For each file, the malware generates a random 32-byte private key and 12-byte nonce via CryptGenRandom, computes a Curve25519 shared secret with the operator's embedded public key, and uses this shared secret directly as the ChaCha20 encryption key. Files are encrypted in 1 MB chunks, with files exceeding 2 GB receiving only 20% partial encryption across evenly-spaced 1 MB blocks for performance optimization. After encryption, per-file keys are securely zeroed from memory. An 8-byte footer marker "payload\0" is appended to each encrypted file, and the footer itself is encrypted with RC4 using the 3-byte key "FBI". Encrypted files receive the .payload extension.
The ransomware deploys extensive anti-forensic measures. ETW (Event Tracing for Windows) is neutralized by patching four functions — EtwEventWrite, EtwEventWriteFull, EtwEventWriteTransfer, and EtwRegister — with return-zero stubs (48 33 C0 C3 for WoW64, 33 C0 C2 14 00 for x86), effectively blinding EDR telemetry. All Windows event log channels are enumerated via EvtOpenChannelEnum and cleared using EvtClearLog. Shadow copies are deleted via "vssadmin.exe delete shadows /all /quiet". The Recycle Bin is emptied using the SHEmptyRecycleBinA API. For self-deletion, the malware renames its own executable to an NTFS Alternate Data Stream (":payload"), marks the file for deletion on handle close, leaving minimal forensic artifacts.
The malware terminates 31 processes (including sql.exe, oracle.exe, excel.exe, winword.exe, outlook.exe, firefox.exe, thunderbird.exe) and stops 34 services (including Veeam, Acronis, BackupExec, YooBackup, Symantec, Sophos, Qihoo 360, and QuickBooks) to maximize encryption coverage of database files, documents, and backups. It supports granular command-line arguments: m (disable mutex), n (disable ransom note), d (disable self-deletion), k (disable process kill), s (skip network shares), l (enable event log deletion), i (ignore filters), bypass-etw, background, algo (encryption path selection), and threads (thread count).
The ransom note (RECOVER_payload.txt or RECOVERY-xx0001.txt) is stored RC4-encrypted in the .rdata section using the key "hQEPINuTY2lytufLDpJQdVkrWlovC1QR" and decrypted at runtime. It presents a 72-hour initial deadline and a 240-hour negotiation window, offering up to 3 free file decryptions (15 MB each) as proof of capability. A debug log is written to C:\payload.log during execution.
The Linux/ESXi variant is a compact ~40 KB ELF binary that specifically targets VMware infrastructure by parsing /etc/vmware/hostd/vmInventory.xml using libxml2 to enumerate virtual machines. It uses /dev/urandom for random number generation and implements a thread pool via C-based thpool with prctl naming. Anti-debugging is achieved by checking the TracerPid field in /proc/self/status. Notably, the ESXi build uses a different operator Curve25519 public key than the Windows variant, suggesting compartmentalized operations or separate affiliate keys.
The Payload group operates a double-extortion model with two Tor hidden services: a negotiation portal and a data leak blog. The ransomware operates in an offline model with no direct C2 communication — all victim interaction occurs through the Tor portal. As of mid-March 2026, the group has claimed 12 victims across 7 countries totaling 2,603 GB of exfiltrated data, targeting healthcare (Royal Bahrain Hospital, 110 GB), telecommunications, energy, real estate, and agriculture sectors, primarily in emerging markets. The mutex "MakeAmericaGreatAgain" serves as a host-level singleton check and reliable IOC.
MITRE ATT&CK techniques used in TL-2026-0340
collection
defense-evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel
discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery
execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules
command-and-control
impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
defense-impairment
Affected products and versions in Payload Ransomware Targeting Windows and VMware ESXi with
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022 - VMware — ESXi
Vulnerable versions: 6.x; 7.x; 8.x - Linux — Linux Kernel
Vulnerable versions: All distributions running VMware ESXi
Remediation for Payload Ransomware Targeting Windows and VMware ESXi with
Immediate actions
- Block Tor exit nodes and known Payload onion domains at perimeter firewalls
- Hunt for mutex MakeAmericaGreatAgain on all Windows endpoints
- Search for .payload file extensions and RECOVER_payload.txt ransom notes across all file shares
- Monitor for vssadmin.exe shadow copy deletion commands
- Deploy YARA rules for Payload Windows PE (SHA256: 1ca67af90400ee6cbbd42175293274a0f5dc05315096cb2e214e4bfe12ffb71f) and Linux ELF (SHA256: bed8d1752a12e5681412efbb8283910857f7c5c431c2d73f9bbc5b379047a316)
- Isolate any VMware ESXi hosts showing signs of unauthorized VM inventory access
Workarounds
- Restrict vssadmin.exe and wmic.exe execution via AppLocker or WDAC policies
- Monitor and alert on ETW provider registration changes
- Disable SMBv1 and restrict SMBv2/v3 share access to authenticated users only
- Enable VMware ESXi lockdown mode to prevent unauthorized management access
Longer-term hardening
- Deploy EDR with ETW tamper detection and behavioral ransomware monitoring
- Implement immutable backup solutions (air-gapped or write-once storage) resistant to Veeam/Acronis service termination
- Enable protected event log forwarding to SIEM before local log clearing can take effect
- Segment VMware management networks from general enterprise traffic
- Implement application whitelisting to prevent unauthorized PE execution
- Deploy canary files and honeypot shares to detect encryption activity early
Weaknesses (CWE) in Payload Ransomware Targeting Windows and VMware ESXi with
CWE-327
Timeline of Payload Ransomware Targeting Windows and VMware ESXi with
- Babuk ransomware source code leaked publicly, providing the foundation for Payload development
- Payload ransomware operations commence with first victim appearing on dark web leak site within hours of binary compilation
- Payload Windows PE binary compiled (2026-02-17 08:39:07 UTC), Linux/ESXi ELF binary first seen on VirusTotal same date
- CYFIRMA weekly intelligence report documents Payload ransomware targeting Windows systems in Mexico and Egypt across real estate and retail sectors
- Payload group claims breach of Royal Bahrain Hospital with 110 GB of patient data exfiltrated, sets March 23 ransom deadline
- Derp Research publishes comprehensive technical analysis of Payload binary with full IOCs, YARA rules released on GitHub
- CyberPress and Netcrook publish coverage of Payload ransomware campaign targeting Windows and ESXi globally
- GBHackers publishes analysis highlighting Babuk-style encryption and dual-platform targeting
- CyberSecurityNews publishes detailed coverage, 12 victims across 7 countries confirmed with 2,603 GB total exfiltration
- Ransom deadline for Royal Bahrain Hospital breach expires
- As of 2026-05-29, Payload ransomware remains an active threat: ransomware.live lists ~50 victims with new ones posted May 21 and the leak site live May 30, and breachsense ranked it the 9th-most-active group (20 victims) in April 2026. No takedown, arrest, or decryptor exists; activity slowed (-50% MoM) but operations continue with the sound Curve25519/ChaCha20 encryption intact.
Sources cited for Payload Ransomware Targeting Windows and VMware ESXi with
- Payload Ransomware: Babuk-Derivative Deep Technical Analysis (Derp Research)
- New Payload Ransomware Uses Babuk-Style Encryption Against Windows and ESXi Systems
- Payload Ransomware Hits Windows and ESXi with Babuk-Style Encryption
- Payload Ransomware: Babuk-Inspired Attacks Hit Windows and ESXi Globally
- Payload Ransomware Uses Babuk-Inspired Encryption In Attacks On Windows and ESXi
- Payload Ransomware Claims Hack of Royal Bahrain Hospital
- YARA Detection Rules for Payload Ransomware (kirkderp)
- CYFIRMA Weekly Intelligence Report - Payload Ransomware Coverage
Threats related to Payload Ransomware Targeting Windows and VMware ESXi with
- Payload Ransomware — Babuk-Derivative ChaCha20 + Curve25519 ECDH Per-File Encryption Targeting Windows and ESXi
- EndPoint (Midnight) Ransomware — Babuk-derived double-extortion targeting Windows, ESXi, and NAS
- EndPoint (formerly Midnight) Babuk-Derived Ransomware — Windows/ESXi/NAS Double Extortion with ChaCha20+RSA Encryption and North Korea-Linked Ransom-Note Lineage (CVE-less, ASEC)
- Payouts King Ransomware — BlackBasta Successor Operation Targeting US Manufacturing, Healthcare, and Construction Sectors
- Coinbase Cartel — Data Exfiltration-Only Ransomware Group Targeting Healthcare, Tech & Transportation
- VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi
Detection coverage for TL-2026-0340
As of 2026-04-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0340 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.