Loading malware…
Payload Ransomware is a Windows-focused file-encrypting ransomware observed by CYFIRMA in underground forums and described in a 2026-03-05 report. It appends the ".payload" extension to encrypted files and drops a ransom note named "RECOVER_payload.txt." The malware is described as operating as double-extortion ransomware, claiming data exfiltration and threatening public disclosure, and directs victims to a Tor-based negotiation portal while offering limited free decryption as proof.
Its behavior includes avoiding critical system directories and executable file types to preserve system stability, deleting shadow copies to inhibit recovery, clearing Windows event logs to reduce forensic visibility, disabling security monitoring via in-memory patching, terminating backup services and productivity applications, enumerating network shares to enable broader encryption impact, and using multi-threaded execution for speed. The report states it selects encryption routines based on processor capabilities and uses ChaCha20 for file encryption with Curve25519 for key exchange. It also relaunches itself in hidden mode and uses NTFS alternate data streams for self-deletion.
High-confidence ATT&CK mappings explicitly cited in the content include T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery), and T1070.004 (File Deletion). A related detection analytic referenced in the content is a Sigma rule for shadow copy deletion using Windows utilities such as vssadmin, wmic, diskshadow, and wbadmin. No specific threat actor attribution, victim sector focus, or concrete IOCs beyond the ransom note filename and ".payload" extension are provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The binary embeds its configuration as RC4-encrypted and base64-encoded blobs in the .rodata section. The RC4 key is the three-byte FBI . All sensitive strings , file paths , error messages and shell commands are decrypted at runtime through mw_w_RC4().
This method is called Dynamic API resolution. The goal of this is to not show all the suspicious initial imports in the IAT, so it looks them up at runtime to evade detection.
Each worker thread on startup calls prctl(PR_SET_NAME, "FBIthread-pool-%d") — the thread name string FBIthread-pool-%d is embedded in plaintext and is a notable forensic indicator.
For each log channel, it calls EvtClearLog to delete its contents. By clearing all event logs, the malware removes important records such as execution history.
Malware immediately at beginning checks if debugger attached to the process by opening /proc/self/status and reads lines until it finds TracerPid: , if the integer following that field is non-zero so debugger is attached , execution branches to delete itself.
ShellExecuteW called with: Verb: open File: cmd.exe Params: /c vssadmin.exe delete shadows /all /quiet
The Linux binary is a lightweight (~39 KB) stripped ELF specifically engineered for VMware ESXi infrastructure. It leverages libxml2.so.2 to parse /etc/vmware/hostd/vmInventory.xml, allowing it to enumerate virtual machine disk paths and encrypt hosted workloads directly.
It first checks if it is running in a 32-bit process on a 64-bit system (WOW64), and temporarily disables file system redirection so it can access the real system tools instead of redirected ones.
For each service, it opens it using OpenServiceA and checks its current state with QueryServiceStatusEx.
Malware calls CreateToolhelp32Snapshot to retrieve a snapshot of all processes and threads in the system. It then iterates through the process list using Process32FirstW and Process32NextW.
To improve performance, it checks the CPU features of the system. If the CPU supports AVX2 or SSE2, it uses an optimized version of ChaCha20.
The malware then accesses a VMware ESXi configuration file (/etc/vmware/hostd/vmInventory.xml) ... It parses <configentry> nodes to extract port identifiers ... datastore paths ... The malware then iterates over collected directories and: Enumerates files within each directory.
Otherwise, it enumerates all available drives, optionally excluding network shares depending on configuration.
The Linux binary is a lightweight (~39 KB) stripped ELF specifically engineered for VMware ESXi infrastructure. It leverages libxml2.so.2 to parse /etc/vmware/hostd/vmInventory.xml, allowing it to enumerate virtual machine disk paths and encrypt hosted workloads directly.
Payload ransomware uses a hybrid encryption scheme combining Curve25519 for key exchange and ChaCha20 for fast file encryption. Each file is encrypted with a unique per-file key, and a footer is appended containing the data required for decryption.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware used by a cybercriminal group that accelerated operations during the Iran war; in the cited incident it targeted Bahrain Royal Hospital and claimed to release stolen data affecting residents of Bahrain and neighboring countries.
File-encrypting, double-extortion ransomware targeting Windows. Appends the .payload extension, drops RECOVER_payload.txt, deletes shadow copies, clears event logs, disables security monitoring, enumerates network shares for lateral encryption, and uses ChaCha20 with Curve25519 for key exchange. Includes a self-deletion mechanism leveraging NTFS alternate data streams.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.