Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Kaspersky details PAYLOAD ransomware operators abusing Active Directory GPOs for encryptionless extortion at a Middle East manufacturer, exfiltrating data published on the dark web.
In April 2026, Kaspersky's GERT responded to a ransomware incident at a Middle East manufacturing organization where attackers with domain admin-equivalent access created a malicious GPO named PAYLOAD linked at the domain root. The GPO delivered ransom notes, hijacked wallpaper and lock screens, enforced a logon banner, and disabled the local administrator account across all domain-joined Windows machines without deploying an encryptor. Initial access came via a compromised FortiGate SSL VPN credential; data was exfiltrated and published on the dark web, and the only ransomware sample found targeted ESXi servers.
- Malicious GPO 'PAYLOAD' at domain root delivered extortion impact without encrypting Windows files
- Entry vector was a compromised domain account on a FortiGate SSL VPN
- Only ransomware binary found targeted ESXi; stolen data published on dark web
- GPO abuse bypasses file- and process-based EDR detection as a trusted SYSTEM-privileged channel
- Case illustrates 2026 trends: living-off-the-land AD abuse and encryptionless extortion
- ATT&CK
- T1078 Valid AccountsT1133 External Remote ServicesT1484.001 Group Policy ModificationT1562.001 Impair Defenses: Disable or Modify ToolsT1491.002 Internal Defacement
- Threat actors
- PAYLOAD operators
- Malware
- PAYLOAD ransomware
- Countries
- Middle East
From the original article
12 min read at securelist.com
Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.
By Ahmad Zaidi Said, Elsayed Elrefaei · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.