Payload Ransomware — Babuk-Derivative ChaCha20 + Curve25519 ECDH Per-File Encryption Targeting Windows and ESXi
Payload Ransomware (TL-2026-0587), also tracked as Payload, is a high-severity ransomware operation, first published 2026-05-26. It is attributed to Payload with low confidence, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1027, T1057, T1070.004), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0587
- Threat ID
- TL-2026-0587
- Also known as
- Payload, Payload Ransomware, Babuk-derivative Payload
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-05-26
- Last reviewed
- 2026-05-26
- Attribution
- Payload
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- logistics, transportation, real_estate, construction, manufacturing, technology, healthcare
- Target regions
- MENA, North Africa, Latin America, Europe, Middle East
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Payload Ransomware
Malware and tooling: payload, curve25519-donna
Payload is a Windows and ESXi ransomware family active since 17 February 2026 that has listed 50+ victims globally (Egypt, Mexico, Poland, Bahrain, MENA) across logistics, real estate, manufacturing, technology and healthcare sectors. It is a heavily modified Babuk derivative that pairs per-file Curve25519 ECDH key derivation (curve25519-donna) with a ChaCha20 stream cipher, 1 MB chunk encryption, and a 56-byte RC4-wrapped (3-byte key 'FBI') key-handoff footer. The malware aggressively erases forensic evidence by patching four ETW functions in ntdll, clearing Application/System/Security event logs, deleting VSS shadow copies, and terminating 30+ processes and 40+ services including SQL, Veeam and Acronis. Researchers (Dark Atlas, Derp.ca) found no cryptographic weakness — no decryption path.
How Payload Ransomware works
Payload is a Windows and ESXi ransomware strain first observed on 17 February 2026 and analyzed in depth by Dark Atlas and Derp.ca in March–May 2026. Telemetry confirms Payload is a heavily modified Babuk derivative that re-uses Babuk's structural conventions while replacing the cryptographic core with a modern Curve25519 + ChaCha20 scheme. By 24 March 2026 the actor had posted 50 victims on its Tor leak site, claiming 2,603 GB of exfiltrated data across seven countries; notable victims include Royal Bahrain Hospital (claimed 15 March 2026 with 110 GB exposed and a 23 March deadline).
Execution begins by acquiring a single-instance mutex named 'MakeAmericaGreatAgain'. The loader resolves Windows NT system calls directly (bypassing user-mode hooks installed by EDR products), opens an operator log at \??\C:\payload.log, and (when the bypass-etw flag is set) patches four event-tracing entry points in ntdll.dll to neutralize ETW-based telemetry. The Windows event log API is loaded at runtime and used to clear the Application, System and Security channels. Volume Shadow Copy Service shadows are deleted via 'vssadmin.exe delete shadows /all /quiet', recovery is further suppressed by labeling the recovery partition 'g:payload', and the malware terminates 30+ processes plus 40+ services — explicitly enumerating SQL Server, Veeam and Acronis services so open database and backup files become encryptable.
The encryption core is per-file and asymmetric. For every target file the malware calls CryptGenRandom to derive a fresh 32-byte Curve25519 private key plus a 12-byte ChaCha20 nonce. It then performs Curve25519 ECDH (using the curve25519-donna implementation, identifiable by the Montgomery ladder pattern and the constant 121665/0x1DB41 in fe_mul121666) between the freshly generated private key and an operator-hardcoded public key embedded in the binary. The resulting shared secret is used directly as the ChaCha20 key (quarter-round rotation constants 16, 12, 8, 7 confirm ChaCha20 vs Salsa20). The file is encrypted in 1 MB chunks using one of three speed-tier code paths chosen via CPUID — AVX2, SSE2, or scalar — yielding aggressive throughput on modern hardware. After encryption the per-file private key is securely zeroed from memory. A 56-byte footer is appended to every encrypted file containing the per-file public key and nonce, the whole footer obfuscated with RC4 keyed on the 3-byte string 'FBI'. Encrypted files receive the '.payload' extension, the ransom note RECOVER_payload.txt is dropped per directory, and victims are given a 240-hour negotiation window via the Tor portal payloadynyvabjacbun4uwhmxc7yvdzorycslzmnleguxjn7glahsvqd[.]onion. Stolen data is published on the leak site payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd[.]onion when victims do not pay.
Independent analysts (Derp.ca) found no cryptographic weakness — no backdoor, no flawed RNG seeding, no recoverable nonce reuse — meaning files encrypted by Payload cannot be recovered without the operator's private key. Defenders should treat Payload as a destructive-impact threat: detection must focus on pre-encryption behavior (mutex creation, ETW patching, vssadmin/wevtutil execution, mass service termination) because once the ChaCha20 stage begins, recovery is impossible without backups.
MITRE ATT&CK techniques used in TL-2026-0587
Defense Evasion
T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion; T1564.010 Hide Artifacts: Process Argument Spoofing
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Software Discovery: Security Software Discovery
Command and Control
T1090.003 Proxy: Multi-hop Proxy
Execution
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583.003 Acquire Infrastructure: Virtual Private Server
defense-impairment
T1685 Disable or Modify Tools; T1685.001 Disable or Modify Windows Event Log; T1685.005 Clear Windows Event Logs
Affected products and versions in Payload Ransomware
- Microsoft — Windows
Vulnerable versions: Windows 10 (all); Windows 11 (all); Windows Server 2016/2019/2022/2025 - VMware (Broadcom) — ESXi
Vulnerable versions: ESXi 6.7; ESXi 7.0; ESXi 8.0 - Veeam — Veeam Backup & Replication
Vulnerable versions: All — services terminated pre-encryption - Acronis — Acronis Cyber Protect
Vulnerable versions: All — services terminated pre-encryption - Microsoft — SQL Server
Vulnerable versions: All — services terminated pre-encryption to release file locks
Remediation for Payload Ransomware
Patches
- No vendor patch — Payload is malware, not a CVE. Apply OS-level hardening: Windows 11 24H2 / Server 2025 with Smart App Control and Memory Integrity (HVCI) enabled to raise the bar for direct-syscall loaders
Immediate actions
- Block known Tor leak/negotiation onion addresses at egress proxies and DNS-over-Tor resolvers where feasible
- Hunt for mutex 'MakeAmericaGreatAgain' across all Windows endpoints (Sysmon EventID 17/18)
- Hunt for the SHA256 1CA67AF90400EE6CBBD42175293274A0F5DC05315096CB2E214E4BFE12FFB71F in EDR file telemetry and binary repositories
- Alert on vssadmin.exe delete shadows /all /quiet executed by any non-administrative process
- Alert on wevtutil cl Application/System/Security executed by any non-IT process tree
- Isolate hosts exhibiting bulk file rename to .payload extension
- Enforce immutable / offline backups for Veeam and Acronis repositories (network-isolated, MFA-protected)
Workarounds
- Block PowerShell, wevtutil, vssadmin, and net.exe stop for unprivileged users via AppLocker / WDAC
- Enable Controlled Folder Access (Microsoft Defender) on workstations and file servers to block unauthorized writes to user document folders
Longer-term hardening
- Deploy EDR with kernel-callback telemetry that cannot be defeated by user-mode ETW patching (e.g. ELAM, Sysmon kernel driver, Microsoft Defender for Endpoint kernel sensors)
- Implement least-privilege service accounts for SQL Server, Veeam and Acronis so a compromised user cannot stop their services
- Enforce VSS protection via Group Policy and protect VSS admin operations with attack-surface-reduction rules
- Deploy honeypot files in user directories to detect mass-encryption behavior early
- Segment backup infrastructure on a dedicated VLAN with one-way replication; verify restore quarterly
Timeline of Payload Ransomware
- Payload ransomware first observed in the wild; earliest sample with mutex 'MakeAmericaGreatAgain' submitted to public sandboxes.
- CYFIRMA Weekly Intelligence Report (05 March 2026) flags Payload as an emerging Babuk-derivative ransomware family targeting Windows and ESXi.
- Payload group claims breach of Royal Bahrain Hospital on its Tor leak site, posting 110 GB of allegedly stolen data with a 23 March payment deadline.
- First public technical write-ups (Cyber Security News, GBHackers, CyberPress) describe Babuk-style encryption and Windows + ESXi targeting.
- Derp.ca publishes deep reverse-engineering analysis confirming curve25519-donna implementation, ChaCha20 quarter-round constants, and absence of cryptographic flaws.
- Payload Tor leak site lists 50 victims across 7 countries with 2,603 GB of claimed exfiltrated data; concentration in Egypt, Mexico, Poland and MENA.
- Threadlinqs Intelligence began tracking TL-2026-0587 (Payload Ransomware) with full MITRE ATT&CK mapping, IOC enrichment and detection package.
- Dark Atlas / Cyber Security News publish follow-up technical analysis detailing the per-file ChaCha20 + Curve25519 ECDH scheme, RC4-wrapped 56-byte footer, and ETW patching of four ntdll functions.
- As of 2026-05-29, Payload ransomware remains a live threat: ransomware.live tracks the group as active with its most recent victim posted 2026-05-21 (50+ total) and no takedown, arrest, or decryptor exists. Independent analysts confirmed no cryptographic weakness, so the ChaCha20/Curve25519 scheme stays unrecoverable; posting velocity dipped ~50% but operations continue.
Sources cited for Payload Ransomware
- Payload Ransomware Uses ChaCha20 and Curve25519 ECDH to Encrypt Windows Files
- Payload ransomware group: mutex MakeAmericaGreatAgain — Babuk derivative analysis
- New 'Payload' Ransomware Uses Babuk-Style Encryption Against Windows and ESXi Systems
- Payload ransomware hits Windows and ESXi with Babuk-style encryption
- Payload Ransomware Uses Babuk-Inspired Encryption In Attacks On Windows and ESXi
- CYFIRMA Weekly Intelligence Report — 05 March 2026
- MITRE ATT&CK T1486 — Data Encrypted for Impact
- MITRE ATT&CK T1490 — Inhibit System Recovery
- MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools
Threats related to Payload Ransomware
- Payload Ransomware Targeting Windows and VMware ESXi with Babuk-Derived Curve25519/ChaCha20 Encryption
- Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026)
- The Gentlemen Ransomware (RaaS) — Defense Evasion TTPs: Event Log Clearing, Defender Disable & AV Exclusions via PowerShell + Scheduled Tasks (Huntress April/May 2026 IRs)
- VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi
- Payouts King Ransomware — BlackBasta-Affiliate RaaS Evades EDR via Direct System Calls, ntdll Export-Table Walking, and SetFileInformationByHandle Rename Evasion (Zscaler ThreatLabz)
- Ransom Cartel ransomware creator Maksim Silnikau sentenced to 16 years in federal prison
Detection coverage for TL-2026-0587
As of 2026-05-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0587 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.