New Payload Ransomware Uses Military-Grade Encryption to Lock Windows Files

What Happened?

Payload ransomware first surfaced in February 2026 and has since established a leak site featuring high-profile victims. The malware uses a two-layer encryption approach that makes file recovery nearly impossible without paying the ransom. ChaCha20, originally developed by cryptographer Daniel Bernstein, provides the primary file encryption, while Curve25519 ECDH handles key exchange between the victim’s machine and the attackers’ servers.

This encryption combination represents a significant step up from typical ransomware operations. Most ransomware groups rely on standard AES encryption, but Payload’s operators chose ChaCha20 for its speed and security advantages on modern processors. The Curve25519 implementation creates unique encryption keys for each infected machine, making mass decryption tools ineffective.

Security researchers first identified Payload’s distinctive encryption signature in attacks against Windows systems across multiple industries. The ransomware targets common file types including documents, images, databases, and backup files. Unlike some ransomware families that encrypt entire drives, Payload focuses on high-value data files while leaving system files intact to maintain machine functionality.

The group’s leak site follows the standard ransomware playbook, threatening to publish stolen data if victims refuse to pay. However, Payload’s operators appear more selective than typical ransomware groups, focusing on targets with valuable intellectual property or sensitive customer data rather than casting a wide net through spam campaigns.

The Impact

The technical sophistication of Payload ransomware signals a troubling evolution in cybercrime operations. ChaCha20 encryption runs faster than AES on most modern hardware while providing equivalent security, making it an attractive choice for attackers who need to encrypt large amounts of data quickly. The addition of Curve25519 ECDH creates a mathematically sound key exchange system that prevents security researchers from developing universal decryption tools.

Organizations hit by Payload face a stark choice between paying substantial ransoms or losing access to critical data permanently. The selective targeting strategy suggests Payload operators conduct extensive reconnaissance before launching attacks. This preparation time allows them to identify the most valuable data and set ransom demands accordingly, potentially leading to higher payment rates than spray-and-pray ransomware campaigns.

How to Avoid This

Organizations can defend against Payload and similar advanced ransomware through layered security approaches. Regular offline backups remain the most effective protection, but they must be stored completely separate from network-connected systems. Payload specifically searches for and encrypts backup files on accessible drives and network shares.

Network segmentation creates additional barriers for ransomware operators. Limiting administrative access and monitoring unusual file encryption activity can help security teams detect attacks before they spread across entire networks. Employee training on email security and safe browsing practices reduces the initial infection vectors that ransomware groups typically exploit.

Given Payload’s focus on high-value targets, organizations should assume they may become victims and prepare incident response plans accordingly. This includes maintaining relationships with cybersecurity firms experienced in ransomware negotiations and recovery, though paying ransoms carries no guarantee of data recovery and funds future criminal operations.