# Payload Ransomware — Babuk-Derivative ChaCha20 + Curve25519 ECDH Per-File Encryption Targeting Windows and ESXi

> Payload is a Windows and ESXi ransomware family active since 17 February 2026 that has listed 50+ victims globally (Egypt, Mexico, Poland, Bahrain, MENA) across logistics, real estate, manufacturing, technology and healthcare sectors. It is a heavily modified Babuk derivative that pairs per-file Curve25519 ECDH key derivation (curve25519-donna) with a ChaCha20 stream cipher, 1 MB chunk encryption, and a 56-byte RC4-wrapped (3-byte key 'FBI') key-handoff footer. The malware aggressively erases forensic evidence by patching four ETW functions in ntdll, clearing Application/System/Security event logs, deleting VSS shadow copies, and terminating 30+ processes and 40+ services including SQL, Veeam and Acronis. Researchers (Dark Atlas, Derp.ca) found no cryptographic weakness — no decryption path.

- **Published:** 2026-05-26T00:00:00Z
- **Last reviewed:** 2026-05-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0587
- **ID:** TL-2026-0587
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Payload
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Payload is a Windows and ESXi ransomware strain first observed on 17 February 2026 and analyzed in depth by Dark Atlas and Derp.ca in March–May 2026. Telemetry confirms Payload is a heavily modified Babuk derivative that re-uses Babuk's structural conventions while replacing the cryptographic core with a modern Curve25519 + ChaCha20 scheme. By 24 March 2026 the actor had posted 50 victims on its Tor leak site, claiming 2,603 GB of exfiltrated data across seven countries; notable victims include Royal Bahrain Hospital (claimed 15 March 2026 with 110 GB exposed and a 23 March deadline).

Execution begins by acquiring a single-instance mutex named 'MakeAmericaGreatAgain'. The loader resolves Windows NT system calls directly (bypassing user-mode hooks installed by EDR products), opens an operator log at \??\C:\payload.log, and (when the bypass-etw flag is set) patches four event-tracing entry points in ntdll.dll to neutralize ETW-based telemetry. The Windows event log API is loaded at runtime and used to clear the Application, System and Security channels. Volume Shadow Copy Service shadows are deleted via 'vssadmin.exe delete shadows /all /quiet', recovery is further suppressed by labeling the recovery partition 'g:payload', and the malware terminates 30+ processes plus 40+ services — explicitly enumerating SQL Server, Veeam and Acronis services so open database and backup files become encryptable.

The encryption core is per-file and asymmetric. For every target file the malware calls CryptGenRandom to derive a fresh 32-byte Curve25519 private key plus a 12-byte ChaCha20 nonce. It then performs Curve25519 ECDH (using the curve25519-donna implementation, identifiable by the Montgomery ladder pattern and the constant 121665/0x1DB41 in fe_mul121666) between the freshly generated private key and an operator-hardcoded public key embedded in the binary. The resulting shared secret is used directly as the ChaCha20 key (quarter-round rotation constants 16, 12, 8, 7 confirm ChaCha20 vs Salsa20). The file is encrypted in 1 MB chunks using one of three speed-tier code paths chosen via CPUID — AVX2, SSE2, or scalar — yielding aggressive throughput on modern hardware. After encryption the per-file private key is securely zeroed from memory. A 56-byte footer is appended to every encrypted file containing the per-file public key and nonce, the whole footer obfuscated with RC4 keyed on the 3-byte string 'FBI'. Encrypted files receive the '.payload' extension, the ransom note RECOVER_payload.txt is dropped per directory, and victims are given a 240-hour negotiation window via the Tor portal payloadynyvabjacbun4uwhmxc7yvdzorycslzmnleguxjn7glahsvqd[.]onion. Stolen data is published on the leak site payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd[.]onion when victims do not pay.

Independent analysts (Derp.ca) found no cryptographic weakness — no backdoor, no flawed RNG seeding, no recoverable nonce reuse — meaning files encrypted by Payload cannot be recovered without the operator's private key. Defenders should treat Payload as a destructive-impact threat: detection must focus on pre-encryption behavior (mutex creation, ETW patching, vssadmin/wevtutil execution, mass service termination) because once the ChaCha20 stage begins, recovery is impossible without backups.

## MITRE ATT&CK

- T1106 Native API
- T1685 Disable or Modify Tools
- T1685.001 Disable or Modify Windows Event Log
- T1685.005 Clear Windows Event Logs
- T1070.004 Indicator Removal: File Deletion
- T1027 Obfuscated Files or Information
- T1564.010 Hide Artifacts: Process Argument Spoofing
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1518.001 Software Discovery: Security Software Discovery
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft
- T1090.003 Proxy: Multi-hop Proxy
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1567 Exfiltration Over Web Service

## Sources

- [Payload Ransomware Uses ChaCha20 and Curve25519 ECDH to Encrypt Windows Files](https://cybersecuritynews.com/payload-ransomware-uses-chacha20/)
- [Payload ransomware group: mutex MakeAmericaGreatAgain — Babuk derivative analysis](https://www.derp.ca/research/payload-ransomware-babuk-derivative/)
- [New 'Payload' Ransomware Uses Babuk-Style Encryption Against Windows and ESXi Systems](https://cybersecuritynews.com/new-payload-ransomware-uses-babuk-style-encryption/)
- [Payload ransomware hits Windows and ESXi with Babuk-style encryption](https://gbhackers.com/payload-ransomware/)
- [Payload Ransomware Uses Babuk-Inspired Encryption In Attacks On Windows and ESXi](https://cyberpress.org/payload-hits-windows-esxi/)
- [CYFIRMA Weekly Intelligence Report — 05 March 2026](https://www.cyfirma.com/news/weekly-intelligence-report-05-march-2026/)
- [MITRE ATT&CK T1486 — Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/)
- [MITRE ATT&CK T1490 — Inhibit System Recovery](https://attack.mitre.org/techniques/T1490/)
- [MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0587