Payload Ransomware Uses ChaCha20 and Curve25519 ECDH to Encrypt Windows Files

Cybersecuritynews •Tushar Subhra Dutta • May 26, 2026

A dangerous new ransomware strain called Payload has been quietly building a global victim list since it first appeared in February 2026. The group launched its leak site with a high-profile target and has since expanded operations across Egypt, Mexico, Poland, and beyond. What makes this threat stand out is not just its reach, but […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Payload Ransomware Targets Global Organizations with ChaCha20 Encryption Payload ransomware, first identified in February 2026, has rapidly expanded its operations, targeting logistics, real estate, and manufacturing sectors worldwide. The malware employs ChaCha20 encryption and Curve25519 ECDH for file encryption, appending the .payload extension to affected files. Its anti-forensic techniques include deleting VSS shadow copies and clearing event logs, making recovery difficult. The group operates via Tor for ransom negotiations and data leaks, with notable activity reported in Egypt, Mexico, and Poland. Defenders are advised to monitor for specific indicators such as the MakeAmericaGreatAgain mutex and the RECOVER_payload.txt ransom note. Immediate isolation of affected hosts and preservation of logs are critical for incident response. The ransomware's sophisticated methods pose a significant threat to organizations that fail to implement robust cybersecurity measures. 2 sources 73

Extracted Entities

Payload Ransomware Uses ChaCha20 and Curve25519 ECDH to Encrypt Windows Files

The full story

Extracted Entities

Attack Types (1)

Countries (3)

MITRE ATT&CK (2)

Platforms (1)

Ransomware Groups (1)