Payload Ransomware
Payload Ransomware is a Windows-focused file-encrypting ransomware observed by CYFIRMA in underground forums and described in a 2026-03-05 report. It appends the ".payload" extension to encrypted files and drops a ransom note named "RECOVER_payload.txt." The malware is described as operating as double-extortion ransomware, claiming data exfiltration and threatening public disclosure, and directs victims to a Tor-based negotiation portal while offering limited free decryption as proof.
Its behavior includes avoiding critical system directories and executable file types to preserve system stability, deleting shadow copies to inhibit recovery, clearing Windows event logs to reduce forensic visibility, disabling security monitoring via in-memory patching, terminating backup services and productivity applications, enumerating network shares to enable broader encryption impact, and using multi-threaded execution for speed. The report states it selects encryption routines based on processor capabilities and uses ChaCha20 for file encryption with Curve25519 for key exchange. It also relaunches itself in hidden mode and uses NTFS alternate data streams for self-deletion.
High-confidence ATT&CK mappings explicitly cited in the content include T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery), and T1070.004 (File Deletion). A related detection analytic referenced in the content is a Sigma rule for shadow copy deletion using Windows utilities such as vssadmin, wmic, diskshadow, and wbadmin. No specific threat actor attribution, victim sector focus, or concrete IOCs beyond the ransom note filename and ".payload" extension are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
4 techniques
Execution
Here we have a very interesting command: /c vssadmin.exe delete shadows /all /quiet. The /c switch is very likely relevant to cmd.exe /c syntax that starts a command.
Privilege Escalation
1 technique
Privilege Escalation
Stealth
8 techniques
Stealth
"Defense Evasion T1027.002 Obfuscated Files or Information: Software Packing"
This method is called Dynamic API resolution. The goal of this is to not show all the suspicious initial imports in the IAT, so it looks them up at runtime to evade detection.
"Privilege Escalation T1055 Process Injection" and "Defense Evasion T1055 Process Injection"; also listed for FishMonger tradecraft.
Before encryption begins, it... clears Windows Event Logs... The ransomware loads the Windows event log API at runtime and clears every available channel, including Application, System, and Security logs.
Discovery
6 techniques
Discovery
Here we have some process names. Usually, before the actual encryption it terminates processes related to documents, SQL databases to ensure everything can be encrypted properly.
The Linux build is a 39 KB stripped ELF targeting ESXi hypervisors. It links libxml2.so.2 and parses /etc/vmware/hostd/vmInventory.xml using XPath to locate VM disk paths for targeted encryption.
The binary encrypts local and network drives, appends a 56-byte footer to each file, renames files with a .payload extension, drops a ransom note, and deletes its own executable.
Lateral Movement
1 technique
Lateral Movement
Collection
1 technique
Collection
Command and Control
2 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
Impact
3 techniques
Impact
Payload ransomware targets Windows systems and appends the “.payload” extension to every file it encrypts. Victims are greeted with a ransom note called RECOVER_payload.txt... Files are encrypted in one-megabyte chunks, and a 56-byte footer is written to the end of every file when the process completes.
Other
3 techniques
Other
Before encryption begins, it... patches event-tracing functions in memory... It terminates over 30 processes and stops more than 40 services before locking files, targeting everything from SQL databases to Veeam and Acronis backup solutions.
IOCs tracked for this family
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware used by a cybercriminal group that accelerated operations during the Iran war; in the cited incident it targeted Bahrain Royal Hospital and claimed to release stolen data affecting residents of Bahrain and neighboring countries.
File-encrypting, double-extortion ransomware targeting Windows. Appends the .payload extension, drops RECOVER_payload.txt, deletes shadow copies, clears event logs, disables security monitoring, enumerates network shares for lateral encryption, and uses ChaCha20 with Curve25519 for key exchange. Includes a self-deletion mechanism leveraging NTFS alternate data streams.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.