Payload Ransomware Recovery: What's Recoverable

Payload appeared in February 2026 and grew quickly, listing around 50 victims on its leak site by late March and continuing to expand through the second quarter across more than a dozen countries, concentrated in manufacturing, business services and healthcare. It runs a double-extortion model across a leak blog and a separate negotiation portal. Victim counts are the group's own claims.

Payload is built on the Babuk source code that leaked in September 2021. It implements Curve25519 with ChaCha20 across Windows and Linux/VMware ESXi builds, appends a .payload extension, and has been reported to include a 56-byte RC4-encrypted footer and anti-forensic techniques.

The Babuk lineage is the useful part. That leaked source is the most reused ransomware code of the last five years, and its ESXi encryptor in particular has been studied extensively, so how this family behaves against datastores and virtual machine disks is better understood than a seven-month-old operation would normally allow.

Independent reverse engineering has reported no cryptographic flaws in the implementation. That is worth stating plainly rather than leaving as an open question: there is no known weakness to exploit, and nobody should be sold recovery on the basis that there might be. Anyone offering guaranteed decryption for this family is either paying the attacker on your behalf or is not being straight with you.

Recovery here is a question of scope rather than cryptography. Where ESXi is involved, that means establishing which datastores and virtual machine disks were reached, whether any snapshots survived, and how completely the large VMDK files were actually written over, since large files are where partial encryption sometimes leaves substantial readable data. Those are answered by examining the files.

Do not reformat affected datastores or delete encrypted files, and preserve the first compromised host rather than rebuilding it. We assess what is realistically recoverable and tell you before any chargeable work begins.