PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain Without Encryption

A PAYLOAD ransomware attack used Active Directory Group Policy Objects to disrupt an entire Windows domain without encrypting files or deploying ransomware binaries.

The operation targeted a manufacturing organization in the Middle East. It relied on domain-level control, stolen credentials, and malicious GPOs to display ransom demands, disable defenses, and lock down administrator access.

In April 2026, the attackers reportedly accessed the organization through its FortiGate SSL VPN using a valid but compromised domain account. The source of the credential theft remains unconfirmed.

However, researchers considered phishing, password spraying, credential stuffing, or credentials purchased from an initial access broker as possible entry paths.

After gaining sufficient privileges, the attackers created a malicious Group Policy Object named PAYLOAD. They linked it to the root of the Active Directory domain.

A domain-root GPO can apply settings to nearly every domain-joined device, making it a powerful mechanism for enterprise-wide administration and, in this case, enterprise-wide disruption.

PAYLOAD Ransomware

The PAYLOAD GPO did not install a traditional ransomware executable on Windows systems. Instead, it used trusted Windows policy mechanisms to copy ransom notes from SYSVOL, replace desktop wallpapers and lock screens with a ransom image, show a logon banner reading “Welcome to Payload!”, and deactivate the local Administrator account.

The attackers also created a second GPO, named “win Firewall Off,” which disabled Windows Firewall across domain, private, and public profiles.

The attack was especially dangerous because it lived almost entirely inside Active Directory. Kaspersky found no encrypted files, no malicious binaries stored on affected Windows machines, no suspicious processes running, and no conventional endpoint persistence such as scheduled tasks, services, Run keys, or WMI subscriptions.

Instead, the malicious GPO link on the domain controller acted as the persistence method. The attackers staged payload.jpg and hello.txt in the organization’s SYSVOL share on April 13.

Endpoint systems cached the policy, but its full effect was delayed because many computer-level settings were applied only when systems rebooted or refreshed policy.

On April 14, endpoints began rebooting, causing ransom wallpapers, lock-screen images, login messages, and ransom-note files to appear across the network.

Kaspersky also observed data exfiltration from file servers and other systems before the visible disruption began. The stolen data was later published on a dark-web leak site, showing that the operation followed an encryptionless extortion model.

Rather than depending on file encryption for leverage, the attackers combined data theft with operational disruption and the threat of further escalation.

Kaspersky said the incident highlights a growing risk for organizations that focus ransomware defenses only on suspicious executables and encryption activity.

GPOs are trusted, allowlisted, and high-privilege administrative tools, so malicious policy changes can bypass security products designed mainly to inspect files, scripts, and processes.

Defenders should monitor Active Directory changes, especially Event IDs 5137 (GPO creation), 5136 (directory-object modifications), and 5141 (deletions).

Security teams should also alert on unexpected changes to the gPLink attribute at the domain root, unusual files in SYSVOL, and GPO modifications made by nonstandard administrative accounts.

Organizations should immediately remove malicious GPOs from domain controllers before cleaning endpoints, rotate compromised credentials, review privileged group memberships, restore firewall and administrator settings through clean policies, and enforce phishing-resistant MFA for VPN access.

Monitoring SYSVOL integrity and separating GPO creation rights from GPO linking rights can further reduce the chance of a domain-wide policy takeover.

IOC Type	Indicator	Description
Malicious GPO	PAYLOAD	Primary ransomware GPO
GPO GUID	{C897F2C7-C2AC-4E6F-BF48-58036FF29E79}	PAYLOAD GPO identifier
Malicious GPO	win Firewall Off	Disables Windows Firewall
GPO GUID	{22099AD2-E062-4F56-B574-5099BBA4E7A6}	Firewall GPO identifier
SYSVOL File	payload.jpg	Ransom wallpaper
SYSVOL File	hello.txt	Ransom-note source
Ransom Note	README-payload.txt	Dropped ransom note
Utility	killer.exe	Process-killing tool
MD5	0108656A3E1ADE6CA4F21B084F5E1208	killer.exe hash
Utility	kill.exe	Process-killing tool
MD5	BEA5E267F24D7DA59F6821BFFDBFF293	kill.exe hash
Registry Key	...\legalnoticecaption	Ransom logon-banner setting
Registry Value	Welcome to Payload!	Ransom banner title
AD Attribute	gPLink	Detect malicious GPO linking
IP	37.19.210[.]12	Reported PAYLOAD indicator
IP	146.70.117[.]239	Reported PAYLOAD indicator
IP	149.102.229[.]154	Reported PAYLOAD indicator
Windows Event ID	5137	GPO object creation
Windows Event ID	5136	GPO/AD modification
Windows Event ID	1102	Security log clearing
Sysmon Event ID	1	Process creation
Sysmon Event ID	5	Process termination
Sysmon Event ID	11	File creation

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC