Payload Ransomware: In-Depth Technical Analysis

Summary

Payload is a Windows ransomware family that encrypts files with ChaCha20 and uses a per-file Curve25519 ECDH exchange, then appends the .payload extension to impacted data. The malware drops a RECOVER_payload.txt ransom note, creates its own log file, and applies several anti-forensic measures, including ETW patching, deletion of VSS shadow copies, clearing of event logs, and termination of selected processes and services. First seen in February 2026, the group rapidly expanded its victim base across several continents, with notable focus on logistics, real estate, and manufacturing organizations. The operators also rely on Tor onion sites for victim communication and data leak publication.

Investigation

The analysis explains the ransomware’s cryptographic workflow, including creation of a fresh 32-byte victim private key, derivation of a shared secret through Curve25519, and direct use of that shared secret as the ChaCha20 encryption key. File encryption is carried out through I/O Completion Ports and concludes with a 56-byte RC4-encrypted footer that contains the victim public key and a constant FBI marker. Its anti-forensic behavior includes in-memory ETW patching, shadow copy deletion via vssadmin, and removal of Windows Event Logs. Researchers also found a predefined kill list of processes and services that the ransomware stops before launching encryption.

Mitigation

Defenders should monitor for the MakeAmericaGreatAgain mutex, newly created .payload files, and the presence of the RECOVER_payload.txt ransom note. Restricting execution of vssadmin.exe and blocking known Tor onion addresses associated with the group can reduce the effectiveness of its anti-forensic and communication methods. Endpoint protections should also detect ETW patching, suspicious NT API file I/O activity, and forced termination of important services. Maintaining regular offline backups and limiting dependence on shadow copies can further reduce business impact.

Response

If Payload ransomware is detected, isolate the affected host from the network immediately, preserve volatile memory, and collect relevant logs for analysis. Investigators should identify and terminate any remaining malicious processes, then prioritize restoration from verified clean backups. If backups are not available, recovery efforts may use the supplied decryption keys together with the embedded RC4 footer to attempt file restoration. Relevant indicators should be shared with threat intelligence teams, and the associated Tor onion infrastructure and any linked command-and-control assets should be blocked.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Shadow‑Copy Deletion (T1561.001): The attacker runs a silent VSS delete command to erase all previous restore points, preventing victims from recovering encrypted files.
  2. Mutex Creation (T1203 – indirect): Payload creates a global mutex named “MakeAmericaGreatAgain” to ensure only one instance runs.
  3. Process Termination (T1203): The ransomware terminates security‑related processes using the TerminateProcess API.
  4. ETW Bypass (T1562.001): The attacker launches a child process with the --bypass-etw flag to silence Event Tracing for Windows.

  All four actions are executed via a single PowerShell script that invokes cmd.exe /c with the exact strings the Sigma rule searches for.

• Regression Test Script:

  # PayloadRansomwareSimulation.ps1
  # Purpose: Generate exactly the command‑line strings the Sigma rule matches.
  
  # 1. Delete all VSS shadow copies (quiet)
  $vssCmd = 'cmd.exe /c vssadmin.exe delete shadows /all /quiet'
  Write-Host "Executing VSS delete..."
  Invoke-Expression $vssCmd
  
  # 2. Create a global mutex named "MakeAmericaGreatAgain"
  $mutexName = 'MakeAmericaGreatAgain'
  $mutex = New-Object System.Threading.Mutex($false, $mutexName)
  if ($mutex.WaitOne(0)) {
      Write-Host "Mutex [$mutexName] created."
  }
  
  # 3. Terminate a dummy process (e.g., notepad) to simulate process termination
  Start-Process notepad
  Start-Sleep -Seconds 2
  $proc = Get-Process -Name notepad -ErrorAction SilentlyContinue
  if ($proc) {
      $terminateCmd = "cmd.exe /c taskkill /PID $($proc.Id) /F"
      Write-Host "Terminating process with command: $terminateCmd"
      Invoke-Expression $terminateCmd
  }
  
  # 4. Launch a benign process with ETW bypass flag
  $etwBypassCmd = 'cmd.exe /c powershell.exe -NoProfile -WindowStyle Hidden --bypass-etw'
  Write-Host "Launching ETW bypass process..."
  Invoke-Expression $etwBypassCmd
  
  Write-Host "Simulation complete. All indicator strings should now be present in Sysmon logs."

• Cleanup Commands:

  # CleanupPayloadRansomwareSimulation.ps1
  # Release the mutex
  $mutexName = 'MakeAmericaGreatAgain'
  $mutex = [System.Threading.Mutex]::OpenExisting($mutexName) -ErrorAction SilentlyContinue
  if ($null -ne $mutex) {
      $mutex.ReleaseMutex()
      $mutex.Close()
      Write-Host "Mutex [$mutexName] released."
  }
  
  # Ensure no leftover notepad processes
  Get-Process -Name notepad -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # No additional cleanup needed for VSS delete (cannot be undone) – note that this is destructive and should only run in an isolated lab.
  Write-Host "Cleanup complete."

End of Report