Payload Ransomware — Babuk-Derivative ChaCha20 + Curve25519 ECDH Per-File Encryption Targeting Windows and ESXi

Payload Ransomware (TL-2026-0587), also tracked as Payload, is a high-severity ransomware operation, first published 2026-05-26. It is attributed to Payload with low confidence, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1027, T1057, T1070.004), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-0587

Threat ID
TL-2026-0587
Also known as
Payload, Payload Ransomware, Babuk-derivative Payload
Severity
HIGH
Status
ACTIVE
Category
RANSOMWARE
First published
2026-05-26
Last reviewed
2026-05-26
Attribution
Payload
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
logistics, transportation, real_estate, construction, manufacturing, technology, healthcare
Target regions
MENA, North Africa, Latin America, Europe, Middle East
Detection rules
9
Indicators of compromise
19

Malware and tooling in Payload Ransomware

Malware and tooling: payload, curve25519-donna

Payload is a Windows and ESXi ransomware family active since 17 February 2026 that has listed 50+ victims globally (Egypt, Mexico, Poland, Bahrain, MENA) across logistics, real estate, manufacturing, technology and healthcare sectors. It is a heavily modified Babuk derivative that pairs per-file Curve25519 ECDH key derivation (curve25519-donna) with a ChaCha20 stream cipher, 1 MB chunk encryption, and a 56-byte RC4-wrapped (3-byte key 'FBI') key-handoff footer. The malware aggressively erases forensic evidence by patching four ETW functions in ntdll, clearing Application/System/Security event logs, deleting VSS shadow copies, and terminating 30+ processes and 40+ services including SQL, Veeam and Acronis. Researchers (Dark Atlas, Derp.ca) found no cryptographic weakness — no decryption path.

How Payload Ransomware works

Payload is a Windows and ESXi ransomware strain first observed on 17 February 2026 and analyzed in depth by Dark Atlas and Derp.ca in March–May 2026. Telemetry confirms Payload is a heavily modified Babuk derivative that re-uses Babuk's structural conventions while replacing the cryptographic core with a modern Curve25519 + ChaCha20 scheme. By 24 March 2026 the actor had posted 50 victims on its Tor leak site, claiming 2,603 GB of exfiltrated data across seven countries; notable victims include Royal Bahrain Hospital (claimed 15 March 2026 with 110 GB exposed and a 23 March deadline).

Execution begins by acquiring a single-instance mutex named 'MakeAmericaGreatAgain'. The loader resolves Windows NT system calls directly (bypassing user-mode hooks installed by EDR products), opens an operator log at \??\C:\payload.log, and (when the bypass-etw flag is set) patches four event-tracing entry points in ntdll.dll to neutralize ETW-based telemetry. The Windows event log API is loaded at runtime and used to clear the Application, System and Security channels. Volume Shadow Copy Service shadows are deleted via 'vssadmin.exe delete shadows /all /quiet', recovery is further suppressed by labeling the recovery partition 'g:payload', and the malware terminates 30+ processes plus 40+ services — explicitly enumerating SQL Server, Veeam and Acronis services so open database and backup files become encryptable.

The encryption core is per-file and asymmetric. For every target file the malware calls CryptGenRandom to derive a fresh 32-byte Curve25519 private key plus a 12-byte ChaCha20 nonce. It then performs Curve25519 ECDH (using the curve25519-donna implementation, identifiable by the Montgomery ladder pattern and the constant 121665/0x1DB41 in fe_mul121666) between the freshly generated private key and an operator-hardcoded public key embedded in the binary. The resulting shared secret is used directly as the ChaCha20 key (quarter-round rotation constants 16, 12, 8, 7 confirm ChaCha20 vs Salsa20). The file is encrypted in 1 MB chunks using one of three speed-tier code paths chosen via CPUID — AVX2, SSE2, or scalar — yielding aggressive throughput on modern hardware. After encryption the per-file private key is securely zeroed from memory. A 56-byte footer is appended to every encrypted file containing the per-file public key and nonce, the whole footer obfuscated with RC4 keyed on the 3-byte string 'FBI'. Encrypted files receive the '.payload' extension, the ransom note RECOVER_payload.txt is dropped per directory, and victims are given a 240-hour negotiation window via the Tor portal payloadynyvabjacbun4uwhmxc7yvdzorycslzmnleguxjn7glahsvqd[.]onion. Stolen data is published on the leak site payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd[.]onion when victims do not pay.

Independent analysts (Derp.ca) found no cryptographic weakness — no backdoor, no flawed RNG seeding, no recoverable nonce reuse — meaning files encrypted by Payload cannot be recovered without the operator's private key. Defenders should treat Payload as a destructive-impact threat: detection must focus on pre-encryption behavior (mutex creation, ETW patching, vssadmin/wevtutil execution, mass service termination) because once the ChaCha20 stage begins, recovery is impossible without backups.

MITRE ATT&CK techniques used in TL-2026-0587

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion; T1564.010 Hide Artifacts: Process Argument Spoofing

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Software Discovery: Security Software Discovery

Command and Control

T1090.003 Proxy: Multi-hop Proxy

Execution

T1106 Native API

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server

defense-impairment

T1685 Disable or Modify Tools; T1685.001 Disable or Modify Windows Event Log; T1685.005 Clear Windows Event Logs

Affected products and versions in Payload Ransomware

  • Microsoft — Windows
    Vulnerable versions: Windows 10 (all); Windows 11 (all); Windows Server 2016/2019/2022/2025
  • VMware (Broadcom) — ESXi
    Vulnerable versions: ESXi 6.7; ESXi 7.0; ESXi 8.0
  • Veeam — Veeam Backup & Replication
    Vulnerable versions: All — services terminated pre-encryption
  • Acronis — Acronis Cyber Protect
    Vulnerable versions: All — services terminated pre-encryption
  • Microsoft — SQL Server
    Vulnerable versions: All — services terminated pre-encryption to release file locks

Remediation for Payload Ransomware

Patches

  • No vendor patch — Payload is malware, not a CVE. Apply OS-level hardening: Windows 11 24H2 / Server 2025 with Smart App Control and Memory Integrity (HVCI) enabled to raise the bar for direct-syscall loaders

Immediate actions

  • Block known Tor leak/negotiation onion addresses at egress proxies and DNS-over-Tor resolvers where feasible
  • Hunt for mutex 'MakeAmericaGreatAgain' across all Windows endpoints (Sysmon EventID 17/18)
  • Hunt for the SHA256 1CA67AF90400EE6CBBD42175293274A0F5DC05315096CB2E214E4BFE12FFB71F in EDR file telemetry and binary repositories
  • Alert on vssadmin.exe delete shadows /all /quiet executed by any non-administrative process
  • Alert on wevtutil cl Application/System/Security executed by any non-IT process tree
  • Isolate hosts exhibiting bulk file rename to .payload extension
  • Enforce immutable / offline backups for Veeam and Acronis repositories (network-isolated, MFA-protected)

Workarounds

  • Block PowerShell, wevtutil, vssadmin, and net.exe stop for unprivileged users via AppLocker / WDAC
  • Enable Controlled Folder Access (Microsoft Defender) on workstations and file servers to block unauthorized writes to user document folders

Longer-term hardening

  • Deploy EDR with kernel-callback telemetry that cannot be defeated by user-mode ETW patching (e.g. ELAM, Sysmon kernel driver, Microsoft Defender for Endpoint kernel sensors)
  • Implement least-privilege service accounts for SQL Server, Veeam and Acronis so a compromised user cannot stop their services
  • Enforce VSS protection via Group Policy and protect VSS admin operations with attack-surface-reduction rules
  • Deploy honeypot files in user directories to detect mass-encryption behavior early
  • Segment backup infrastructure on a dedicated VLAN with one-way replication; verify restore quarterly

Timeline of Payload Ransomware

  • Payload ransomware first observed in the wild; earliest sample with mutex 'MakeAmericaGreatAgain' submitted to public sandboxes.
  • CYFIRMA Weekly Intelligence Report (05 March 2026) flags Payload as an emerging Babuk-derivative ransomware family targeting Windows and ESXi.
  • Payload group claims breach of Royal Bahrain Hospital on its Tor leak site, posting 110 GB of allegedly stolen data with a 23 March payment deadline.
  • First public technical write-ups (Cyber Security News, GBHackers, CyberPress) describe Babuk-style encryption and Windows + ESXi targeting.
  • Derp.ca publishes deep reverse-engineering analysis confirming curve25519-donna implementation, ChaCha20 quarter-round constants, and absence of cryptographic flaws.
  • Payload Tor leak site lists 50 victims across 7 countries with 2,603 GB of claimed exfiltrated data; concentration in Egypt, Mexico, Poland and MENA.
  • Threadlinqs Intelligence began tracking TL-2026-0587 (Payload Ransomware) with full MITRE ATT&CK mapping, IOC enrichment and detection package.
  • Dark Atlas / Cyber Security News publish follow-up technical analysis detailing the per-file ChaCha20 + Curve25519 ECDH scheme, RC4-wrapped 56-byte footer, and ETW patching of four ntdll functions.
  • As of 2026-05-29, Payload ransomware remains a live threat: ransomware.live tracks the group as active with its most recent victim posted 2026-05-21 (50+ total) and no takedown, arrest, or decryptor exists. Independent analysts confirmed no cryptographic weakness, so the ChaCha20/Curve25519 scheme stays unrecoverable; posting velocity dipped ~50% but operations continue.

Sources cited for Payload Ransomware

Threats related to Payload Ransomware

Detection coverage for TL-2026-0587

As of 2026-05-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0587 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats