PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain

A ransomware incident in which attackers used Active Directory Group Policy to disrupt operations without deploying a Windows encryptor or leaving malware running on endpoints.

In April 2026, the attackers accessed a FortiGate SSL VPN using compromised domain credentials, then gained domain-admin-equivalent rights.

PAYLOAD Ransomware

On April 13, Kaspersky’s Global Emergency Response Team (GERT) created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the Active Directory domain, allowing it to affect all domain-joined systems.

Instead of encrypting files on workstations, the policy employed Windows administrative functions to copy ransom notes from SYSVOL, set a ransom image as users’ wallpaper and lock screen, configure a “Welcome to Payload!” logon banner, and deactivate the local Administrator account.

Additionally, a second root-linked GPO named “win Firewall Off” disabled the Windows Firewall across domain, private, and public profiles.

This combination created a widespread impact on the enterprise while avoiding typical ransomware detection. GPO processing is a legitimate Windows management mechanism, so the attack logic lived in the malicious configuration rather than in executables.

During their examination, Kaspersky found no encrypted files on Windows endpoints, malicious binaries, persistence on endpoints, injected code, or malicious processes.

The attackers staged “payload.jpg” and “hello.txt” in the domain controller’s SYSVOL share. The PAYLOAD policy copied the text file to the desktop and root locations as a read-only file called “README-payload.txt,” and applied the image as the wallpaper and lock screen.

It modified the registry values for “legalnoticecaption” and “legalnoticetext,” and used “GptTmpl.inf” security settings to disable the Administrator account.

A one-day delay separated weaponization and disruption. Policy artifacts were written and cached on April 13. However, the actual impact began after endpoints rebooted on April 14 and the computer settings took effect.

This timing gave the attackers a window to stage, as investigators noticed exfiltration from file servers, with data later published on a dark web site.

This incident highlights how a GPO link can serve as both a disruption mechanism and a persistence point. Simply removing local artifacts would not resolve the compromise, as the domain controller would reapply the settings during the next refresh or restart.

Responders must remove malicious GPOs and SYSVOL-hosted files, restore firewall and local administrator settings with a clean policy, and rotate compromised and privileged credentials. If Domain Admin compromise is confirmed, organizations should reset the krbtgt account twice.

Detection efforts should focus on Active Directory and SYSVOL. Teams should enable Directory Service Change auditing and investigate Event IDs 5137, 5136, and 5141, particularly for nonstandard accounts creating or modifying groupPolicyContainer objects or modifying gPLink at the domain root.

File integrity monitoring should alert on any changes to images, text files, scripts, registry.pol, and GptTmpl.inf under SYSVOL. The logs in Endpoint Group Policy Operational logs, Group Policy History, and Shadow registry locations can help verify policy application after the attack.

This case reinforces the trend toward encryptionless extortion. Although a PAYLOAD sample targeting ESXi was found on Linux infrastructure, the impact on Windows systems relied on abusing the victim’s identity and management plane.

Defenders should enforce phishing-resistant multi-factor authentication (MFA) for VPN access, separate GPO creation from linking permissions, restrict Tier 0 administration, and monitor every domain-root policy change as a large-scale incident.

IOC Table

IOC Type	Indicator	Description
Malicious GPO	PAYLOAD	GPO GUID: {C897F2C7-C2AC-4E6F-BF48-58036FF29E79}
Malicious GPO	win Firewall Off	GPO GUID: {22099AD2-E062-4F56-B574-5099BBA4E7A6}
SYSVOL file	payload.jpg	Ransom image used for desktop wallpaper and lock screen
SYSVOL file	hello.txt	Source ransom note copied through Group Policy Preferences
Dropped file	README-payload.txt	Read-only ransom note written to desktops and C:\ / D:\ roots
Tool	killer.exe	Process-killing utility; MD5: 0108656A3E1ADE6CA4F21B084F5E1208
Tool	kill.exe	Process-killing utility; MD5: BEA5E267F24D7DA59F6821BFFDBFF293
Registry value	HKLM\...\Policies\System\legalnoticecaption	Set to Welcome to Payload!
SYSVOL path	\\DC.THECOMPANY.local\sysvol\THECOMPANY.local\payload.jpg	Domain-hosted ransom wallpaper source
Windows Event ID	5137	Creation of a GPO object; review creator identity
Windows Event ID	5136	GPO attribute modification; monitor domain-root gPLink changes
Windows Event ID	5141	GPO object deletion; relevant for tampering and remediation validation
IP address	37.19.210[.]12	Associated network indicator
IP address	146.70.117[.]239	Associated network indicator
IP address	149.102.229[.]154	Associated network indicator
IP address	104.164.55[.]46	Associated network indicator
IP address	192.42.116[.]50	Associated network indicator

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC