PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain
PAYLOAD ransomware abused Active Directory Group Policy to disrupt a Windows domain without using file encryption.
A ransomware incident used Active Directory Group Policy Objects (GPOs) to disrupt a Windows domain without encrypting files or leaving malware on endpoints. Attackers gained access via compromised credentials on a FortiGate SSL VPN and used malicious GPOs to deploy ransom notes and disable firewalls. This approach bypassed traditional ransomware detection by abusing legitimate administrative tools.
- PAYLOAD ransomware abused Active Directory Group Policy to disrupt a Windows domain without file encryption.
- Attackers used compromised credentials to gain domain-admin rights via a FortiGate SSL VPN.
- Malicious GPOs were used to deploy ransom notes, set wallpapers, and disable firewalls across the domain.
- The attack required no malware on endpoints, relying on legitimate Windows management mechanisms.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.164.55.46 | s 149.102.229[.]154 Associated network indicator IP address 104.164.55[.]46 Associated network indicator IP address 192.42.116[.]50 A |
| ipv4 | 146.70.117.239 | ress 37.19.210[.]12 Associated network indicator IP address 146.70.117[.]239 Associated network indicator IP address 149.102.229[.]154 |
| ipv4 | 149.102.229.154 | ss 146.70.117[.]239 Associated network indicator IP address 149.102.229[.]154 Associated network indicator IP address 104.164.55[.]46 A |
| ipv4 | 192.42.116.50 | ess 104.164.55[.]46 Associated network indicator IP address 192.42.116[.]50 Associated network indicator Note: IP addresses and domai |
| ipv4 | 37.19.210.12 | elevant for tampering and remediation validation IP address 37.19.210[.]12 Associated network indicator IP address 146.70.117[.]239 |
| md5 | 0108656a3e1ade6ca4f21b084f5e1208 | \ / D:\ roots Tool killer.exe Process-killing utility; MD5: 0108656A3E1ADE6CA4F21B084F5E1208 Tool kill.exe Process-killing utility; MD5: BEA5E267F24D7DA |
| md5 | bea5e267f24d7da59f6821bffdbff293 | 4F21B084F5E1208 Tool kill.exe Process-killing utility; MD5: BEA5E267F24D7DA59F6821BFFDBFF293 Registry value HKLM\...\Policies\System\legalnoticecaption |
From the original article
3 min read at gbhackers.com
A ransomware incident in which attackers used Active Directory Group Policy to disrupt operations without deploying a Windows encryptor or leaving malware running on endpoints. In April 2026, the attackers accessed a FortiGate SSL VPN using compromised domain credentials, then gained domain-admin-equivalent rights. PAYLOAD Ransomware On April 13, Kaspersky’s Global Emergency Response Team (GERT) created […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.