Payload Ransomware Targets Global Organizations with ChaCha20 Encryption

Socprime

Payload Ransomware Targets Global Organizations with ChaCha20 Encryption

First seen 26 May 2026, 18:29 UTC • •72.5

Article Content

1 / 3

Browse articles

ThreatCluster •May 27, 2026 at 18:11 UTC

•Payload ransomware uses ChaCha20 and Curve25519 for file encryption.
•The malware employs aggressive anti-forensic techniques to hinder recovery efforts.
•Organizations in logistics, real estate, and manufacturing are primary targets.

Payload ransomware, first identified in February 2026, has rapidly expanded its operations, targeting logistics, real estate, and manufacturing sectors worldwide. The malware employs ChaCha20 encryption and Curve25519 ECDH for file encryption, appending the .payload extension to affected files. Its anti-forensic techniques include deleting VSS shadow copies and clearing event logs, making recovery difficult. The group operates via Tor for ransom negotiations and data leaks, with notable activity reported in Egypt, Mexico, and Poland. Defenders are advised to monitor for specific indicators such as the MakeAmericaGreatAgain mutex and the RECOVER_payload.txt ransom note. Immediate isolation of affected hosts and preservation of logs are critical for incident response. The ransomware's sophisticated methods pose a significant threat to organizations that fail to implement robust cybersecurity measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 141d ago How this analysis works

Timeline

2026-02-01

Payload ransomware first detected

Payload ransomware was first identified in February 2026, quickly gaining traction across various sectors.

2026-05-26

Ransomware expands global victim list

Payload ransomware has been linked to victims in Egypt, Mexico, and Poland, indicating a broad operational scope.

Cybersecuritynews

2026-05-26

Defensive measures recommended

Experts recommend monitoring specific indicators and isolating affected hosts to mitigate the ransomware's impact.

More articles in this cluster (2)

Threat Graph

13 entities, 19 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (7)

Ransomware
T1059.001 - PowerShell
T1059.003 - Windows Command Shell
T1070.001 - Clear Windows Event Logs
T1486 - Data Encrypted for Impact
T1490 - Inhibit System Recovery
T1567.002 - Exfiltration to Cloud Storage

Affected Platform (1)

Windows

Threat Actor (2)

Payload Ransomware
Payload

Tool (3)

Cmd.exe
PowerShell
Vssadmin

Relationships

Payload Ransomware uses Cmd.exe
Payload Ransomware uses PowerShell
Payload Ransomware uses Vssadmin
Payload uses Cmd.exe
Payload uses PowerShell
Payload uses Vssadmin
Payload Ransomware uses Ransomware
Payload Ransomware uses T1059.001 - PowerShell
Payload Ransomware uses T1059.003 - Windows Command Shell
Payload Ransomware uses T1070.001 - Clear Windows Event Logs
Payload Ransomware uses T1486 - Data Encrypted for Impact
Payload uses Ransomware
Payload uses T1059.001 - PowerShell
Payload uses T1059.003 - Windows Command Shell
Payload uses T1070.001 - Clear Windows Event Logs
Payload uses T1486 - Data Encrypted for Impact
Payload Ransomware related to T1490 - Inhibit System Recovery
Payload Ransomware related to T1567.002 - Exfiltration to Cloud Storage
Payload Ransomware related to Windows

Following this threat?

Track Payload Ransomware in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

FortiBleed Campaign Locks Out Admins, Compromises 86,644 Fortinet Devices The FBI and U.S. Secret Service have issued a warning regarding the ongoing FortiBleed campaign, which targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. This credential-harvesting operation has compromised over 86,644 devices across 194 countries, exploiting reused or leaked credentials and…

Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…