Payload Ransomware Uses ChaCha20 and Curve25519 ECDH to Encrypt Windows Files

A dangerous new ransomware strain called Payload has been quietly building a global victim list since it first appeared in February 2026. The group launched its leak site with a high-profile target and has since expanded operations across Egypt, Mexico, Poland, and beyond. What makes this threat stand out is not just its reach, but […] The post Payload Ransomware Uses ChaCha20 and Curve25519 ECDH to Encrypt Windows Files appeared first on Cyber Security News.