Back Cybersecuritynews

New ‘Payload’ Ransomware Uses Babuk

Cybersecuritynews •Tushar Subhra Dutta • March 17, 2026

A newly identified ransomware strain called “Payload” has emerged as a serious threat to organizations across multiple sectors, combining strong encryption techniques with advanced anti-forensic capabilities. The group behind it has been active since at least February 17, 2026 — the same day its Windows binary was compiled — and the first victim appeared on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Payload Ransomware Targets Windows and ESXi with Babuk Encryption A new ransomware strain named 'Payload' has emerged, posing a significant threat to organizations utilizing Windows and VMware ESXi systems. The group behind Payload has been active since at least February 17, 2026, and employs Babuk-style cryptography along with advanced anti-forensic techniques. Initial reports indicate that mid-to-large organizations across various sectors and countries are being targeted. The ransomware operates on a double-extortion model, demanding payment for decryption keys and threatening to leak sensitive data. As of now, specific numbers of victims or financial impacts have not been disclosed. The first victim was reported shortly after the ransomware's Windows binary was compiled. Security professionals are urged to remain vigilant as the group continues to expand its operations. 2 sources 68

Extracted Entities

New ‘Payload’ Ransomware Uses Babuk

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Ransomware Groups (2)