Payload Ransomware Emerges With Robust Encryption and Anti-Forensics

Researchers reported that Payload is a newly observed ransomware strain targeting Windows environments and rapidly expanding its operations, with about 50 victims listed on its leak site by late March. The malware appends the .payload extension to encrypted files and drops a ransom note named RECOVER_payload.txt, while focusing on sectors where downtime can quickly drive extortion pressure, including logistics, transportation, construction, real estate, manufacturing, and technology. Technical analysis indicates Payload uses a mature cryptographic design built on per-file Curve25519 ECDH key exchange and ChaCha20 encryption, making recovery without the operators’ private key effectively infeasible.

The ransomware also uses aggressive anti-forensics and disruption tactics before encryption, including deleting shadow copies, clearing Windows Event Logs, patching ETW-related functions in ntdll, terminating processes, and stopping backup and database services. Separate reporting on Vect highlighted a contrasting trend in the ransomware ecosystem: although Vect marketed enterprise-focused cross-platform ransomware for Windows, Linux, and ESXi, researchers found a critical cryptographic flaw that irreversibly destroys files larger than 128 KB, effectively turning many attacks into data wiping events even if victims pay. Together, the findings show a split between technically competent operators such as Payload and poorly engineered ransomware like Vect that can still cause severe business disruption.