Back Gbhackers

Payload ransomware hits Windows and ESXi with Babuk

Gbhackers •Mayura Kathir • March 17, 2026

A new ransomware operation called Payload is rapidly emerging as a serious threat to both Windows and VMware ESXi environments, combining Babuk-style cryptography with aggressive anti-forensics and a working double-extortion model. The group claims to have been active since at least February 17, 2026. It is already hitting mid-to-large organizations across multiple sectors and countries. The hospital […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Payload Ransomware Targets Windows and ESXi with Babuk Encryption A new ransomware strain named 'Payload' has emerged, posing a significant threat to organizations utilizing Windows and VMware ESXi systems. The group behind Payload has been active since at least February 17, 2026, and employs Babuk-style cryptography along with advanced anti-forensic techniques. Initial reports indicate that mid-to-large organizations across various sectors and countries are being targeted. The ransomware operates on a double-extortion model, demanding payment for decryption keys and threatening to leak sensitive data. As of now, specific numbers of victims or financial impacts have not been disclosed. The first victim was reported shortly after the ransomware's Windows binary was compiled. Security professionals are urged to remain vigilant as the group continues to expand its operations. 2 sources 68

Extracted Entities

Payload ransomware hits Windows and ESXi with Babuk

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (2)

Ransomware Groups (2)