PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain Without Encryption
PAYLOAD ransomware crew hijacked Active Directory GPOs to disrupt a Middle East manufacturer's entire Windows domain without encrypting files.
Kaspersky detailed an April 2026 PAYLOAD operation against a Middle East manufacturing firm that entered through a FortiGate SSL VPN using a compromised domain account. Attackers linked a malicious GPO named PAYLOAD to the AD domain root to push ransom notes, wallpapers, a 'Welcome to Payload!' logon banner, and disable the local Administrator account, while a second GPO ('win Firewall Off') disabled Windows Firewall across all profiles. No files were encrypted and no binaries were deployed; persistence came from the GPO link itself, with payload.jpg and hello.txt staged in SYSVOL. Data exfiltrated before the disruption was later published on a dark-web leak site, an encryptionless extortion model.
- Initial access via FortiGate SSL VPN with a valid compromised domain account; credential theft source unconfirmed.
- Domain-root GPO delivered ransom notes, wallpapers, and disabled local Administrator without any ransomware binary.
- Second GPO 'win Firewall Off' disabled Windows Firewall on domain, private, and public profiles.
- No encryption or endpoint persistence; stolen data published on dark-web leak site.
- Monitor Event IDs 5136/5137/5141 and unexpected gPLink changes at the domain root.
- ATT&CK
- T1078 Valid AccountsT1484.001 Domain Policy Modification: Group Policy ModificationT1562.001 Impair Defenses: Disable or Modify ToolsT1531 Account Access RemovalT1491.001 Internal Defacement: Internal Defacement
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 146.70.117.239 | GPO linking IP 37.19.210[.]12 Reported PAYLOAD indicator IP 146.70.117[.]239 Reported PAYLOAD indicator IP 149.102.229[.]154 Reported |
| ipv4 | 149.102.229.154 | indicator IP 146.70.117[.]239 Reported PAYLOAD indicator IP 149.102.229[.]154 Reported PAYLOAD indicator Windows Event ID 5137 GPO obje |
| ipv4 | 37.19.210.12 | r title AD Attribute gPLink Detect malicious GPO linking IP 37.19.210[.]12 Reported PAYLOAD indicator IP 146.70.117[.]239 Reported P |
| md5 | 0108656a3e1ade6ca4f21b084f5e1208 | ped ransom note Utility killer.exe Process-killing tool MD5 0108656A3E1ADE6CA4F21B084F5E1208 killer.exe hash Utility kill.exe Process-killing tool MD5 B |
| md5 | bea5e267f24d7da59f6821bffdbff293 | 8 killer.exe hash Utility kill.exe Process-killing tool MD5 BEA5E267F24D7DA59F6821BFFDBFF293 kill.exe hash Registry Key ...\legalnoticecaption Ransom lo |
From the original article
3 min read at cybersecuritynews.com
A PAYLOAD ransomware attack used Active Directory Group Policy Objects to disrupt an entire Windows domain without encrypting files or deploying ransomware binaries. The operation targeted a manufacturing organization in the Middle East. It relied on domain-level control, stolen credentials, and malicious GPOs to display ransom demands, disable defenses, and lock down administrator access.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.