Loading story…
Researchers reported that Payload is a newly observed ransomware strain targeting Windows environments and rapidly expanding its operations, with about 50 victims listed on its leak site by late March. The malware appends the .payload extension to encrypted files and drops a ransom note named RECOVER_payload.txt, while focusing on sectors where downtime can quickly drive extortion pressure, including logistics, transportation, construction, real estate, manufacturing, and technology. Technical analysis indicates Payload uses a mature cryptographic design built on per-file Curve25519 ECDH key exchange and ChaCha20 encryption, making recovery without the operators’ private key effectively infeasible.
The ransomware also uses aggressive anti-forensics and disruption tactics before encryption, including deleting shadow copies, clearing Windows Event Logs, patching ETW-related functions in ntdll, terminating processes, and stopping backup and database services. Separate reporting on Vect highlighted a contrasting trend in the ransomware ecosystem: although Vect marketed enterprise-focused cross-platform ransomware for Windows, Linux, and ESXi, researchers found a critical cryptographic flaw that irreversibly destroys files larger than 128 KB, effectively turning many attacks into data wiping events even if victims pay. Together, the findings show a split between technically competent operators such as Payload and poorly engineered ransomware like Vect that can still cause severe business disruption.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Dark Atlas released an in-depth technical analysis of Payload ransomware, detailing its encryption design, anti-forensics behavior, and operational tradecraft. The report characterized Payload as a technically mature and expanding ransomware operation.
Check Point Research reported that Vect 2.0 and an earlier in-the-wild version contain a cryptographic bug that irreversibly destroys files larger than 128 KB on Windows, Linux, and ESXi. The flaw overwrites nonce values during chunked encryption, making decryption impossible even if victims pay.
Vect and TeamPCP publicly promoted a partnership on BreachForums to monetize earlier supply-chain compromises through follow-on extortion activity, and Vect also offered affiliate keys and tooling to forum users. This exposure later enabled researchers to access the group's panel and builder.
By March 24, 2026, Payload had listed 50 victims on its leak site, indicating rapid expansion and broad targeting across sectors including logistics, transportation, construction, manufacturing, and technology.
Payload was first observed in February 2026 as a new ransomware strain targeting Windows systems. It used ChaCha20 with Curve25519 ECDH, appended the .payload extension to encrypted files, and deployed anti-forensics measures such as deleting shadow copies and clearing event logs.
A new ransomware-as-a-service operation named Vect emerged on the Russian-speaking forum Rehub, advertising a cross-platform C++ locker for Windows, Linux, and VMware ESXi with enterprise-focused features and an affiliate program. At that stage, no public victims had yet been listed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcedarkatlas.io
Open sourcehelpnetsecurity.com
Open sourcetheregister.com
Open sourceflare.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026
Researchers have identified **Vect** as a new ransomware-as-a-service operation advertising a purportedly custom-built C++ locker for **Windows, Linux, and VMware ESXi**. The group began recruiting affiliates on a Russian-language cybercrime forum and promotes features including **ChaCha20-Poly1305** encryption, intermittent encryption for faster impact, Safe Mode execution, SMB and WinRM propagation, GPO-based deployment, and built-in packing or crypter functionality. Vect also operates **TOR-only** infrastructure for affiliate onboarding, victim communications, and leak-site publishing, and appears to follow a **double-extortion** model. The group has publicly claimed two victims in **Brazil** and **South Africa**, although neither the intrusions nor the full malware capabilities have been independently verified. Researchers said Vect shows unusually strong operational maturity for a newly observed crew, citing Monero payments, TOX communications, and a revenue-sharing model that waives entry fees for CIS-based affiliates while charging non-CIS applicants. Reporting suggests the operators may be experienced ransomware actors or a rebrand, and defenders were urged to harden exposed **RDP/VPN** and edge appliances such as Fortinet interfaces, segment management networks, watch for Safe Mode abuse and intermittent encryption, and strengthen anti-ransomware controls.
Jul 2, 2026
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026