Payload is a double-extortion ransomware operation that has posted victims since February 2026. Encrypted files end in .payload, and the dropped note RECOVER_payload.txt begins with the greeting "Welcome to Payload!". It sets a 72-hour deadline before the stolen file tree is published, and a 240-hour deadline to finish negotiating through a Tor login page. The Windows and Linux builds pair ChaCha20 file encryption with Curve25519 key exchange. They inherit code from the leaked Babuk source and stop backup software before encrypting. Data theft before encryption is central to the scheme, and the group runs its own leak blog.
File extensions: .payload
Ransom note filenames: RECOVER_payload.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161