Since its debut in February 2026, the new Payload ransomware group has quickly established a global footprint by targeting high-value organizations across multiple continents.
Cyber threat monitors at WatchGuard observed the group launching a dedicated leak site on the Tor network to publicize their compromised victims.
According to intelligence gathered by CYFIRMA, the Payload ransomware surfaced on underground forums before aggressively scaling its operations to target victims in Egypt, Mexico, Poland, and the broader Middle East.
The threat actors focus extensively on opportunistic targets with high disruption value, particularly within logistics, transportation, real estate, and construction.
Threat intelligence platforms like Bitsight have documented recent retail sector casualties, including the Singaporean company Robinsons, illustrating the indiscriminate and expansive nature of this campaign.
Reports from FalconFeedsio also indicate expanding targets in the European and food industries, demonstrating that the operators are positioning themselves as a formidable international threat.
This operational momentum allowed the group to publicly list fifty compromised organizations by March 2026, placing immense financial pressure on enterprises tied to critical supply chains.
Payload Ransomware Hits Windows
The malware is deployed as a PE32 Windows executable that systematically encrypts victim files using a highly sophisticated encryption pipeline.
Researchers at GBHackers note that reverse-engineering the binary reveals a complete and well-implemented Babuk-style cryptographic scheme.
The Payload executable uses ChaCha20 for file encryption, along with a fresh Curve25519 Elliptic-Curve Diffie-Hellman key exchange generated for each file.
During execution, the malware generates a unique 32-byte victim private key and a 12-byte nonce, which are then used to derive a shared secret that serves as the ChaCha20 key without a separate key derivation function.
Threat analysts at RansomLook have analyzed the embedded master operator public key used during this process and confirmed its strict 32-byte length requirement for the X25519 exchange.
As the ransomware locks files in one-megabyte chunks, it appends the .payload extension to the altered filenames.
The routine finalizes each file by attaching a 56-byte RC4-encrypted footer that safely stores the victim’s ephemeral public key and nonce, ensuring only the attackers can calculate the final decryption key.
Furthermore, the operators demand negotiations within an aggressively short timeframe by depositing a custom ransom note titled RECOVER_payload.txt in the affected system directories.
According to Darkatlas research, payload ransomware distinguishes itself through an aggressive suite of anti-forensic capabilities designed to blind security tools and cripple incident response efforts.
Cybersecurity firm Proven Data reports that the ransomware actively patches Event Tracing for Windows in memory, effectively blinding Endpoint Detection and Response solutions before offline encryption even begins.
This technique alters critical functions inside the system libraries to suppress event records, ensuring the encryption process remains undetected by behavioral monitors.
Additionally, the malware systematically enumerates and destroys all Volume Shadow Copy Service snapshots using administrative commands, permanently blocking simple operating system data recovery efforts.
Indicators of Compromise
| IOC Type | Value |
|---|---|
| MD5 | E0FD8FF6D39E4C11BDAF860C35FD8DC0 |
| SHA1 | DDE1B933AAD33C5D96C2E45AD46434A200DC46A6 |
| SHA256 | 1CA67AF90400EE6CBBD42175293274A0F5DC05315096CB2E214E4BFE12FFB71F |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
