Dark Web Intelligence on X: " PAYLOAD RANSOMWARE WEAPONIZES ACTIVE DIRECTORY

Dark Web Intelligence on X: "🚨 PAYLOAD RANSOMWARE WEAPONIZES ACTIVE DIRECTORY — NO WINDOWS ENCRYPTOR NEEDED

Kaspersky GERT has disclosed a ransomware incident where attackers turned the victim’s own Active Directory Group Policy infrastructure into the disruptive payload.

• The victim was a manufacturing organization in the Middle East

• Initial access used a compromised valid account through FortiGate SSL VPN

• Attackers obtained domain-admin-equivalent control and created a malicious domain-root GPO named PAYLOAD

• The GPO pushed ransom notes, replaced wallpaper and lock screens, enforced a ransom logon banner and disabled the local administrator account across domain-joined Windows systems

• A second GPO named win Firewall Off disabled Windows Firewall across all profiles

• No Windows files were encrypted and no ransomware binary, endpoint persistence or malicious process was found on affected workstations

• Data was exfiltrated from file servers and other systems and later published on the dark web

• Kaspersky did observe a PAYLOAD ransomware sample targeting ESXi/Linux servers

• The malicious GPO remained effectively dormant until endpoints rebooted, creating roughly a one-day gap between policy creation and visible disruption

This is a notable example of encryptionless ransomware impact delivered through trusted enterprise infrastructure itself.

Once an attacker controls domain-level Group Policy, conventional endpoint detections looking for an encryptor can miss the attack entirely. The persistence and payload effectively live in Active Directory/SYSVOL rather than on individual workstations.

#Ransomware #ActiveDirectory #PAYLOAD #GPO #ThreatIntel #CyberSecurity #DDW #DarkWeb"

🚨 PAYLOAD RANSOMWARE WEAPONIZES ACTIVE DIRECTORY — NO WINDOWS ENCRYPTOR NEEDED

Kaspersky GERT has disclosed a ransomware incident where attackers turned the victim’s own Active Directory Group Policy infrastructure into the disruptive payload.

• The victim was a manufacturing organization in the Middle East

• Initial access used a compromised valid account through FortiGate SSL VPN

• Attackers obtained domain-admin-equivalent control and created a malicious domain-root GPO named PAYLOAD

• The GPO pushed ransom notes, replaced wallpaper and lock screens, enforced a ransom logon banner and disabled the local administrator account across domain-joined Windows systems

• A second GPO named win Firewall Off disabled Windows Firewall across all profiles

• No Windows files were encrypted and no ransomware binary, endpoint persistence or malicious process was found on affected workstations

• Data was exfiltrated from file servers and other systems and later published on the dark web

• Kaspersky did observe a PAYLOAD ransomware sample targeting ESXi/Linux servers

• The malicious GPO remained effectively dormant until endpoints rebooted, creating roughly a one-day gap between policy creation and visible disruption

This is a notable example of encryptionless ransomware impact delivered through trusted enterprise infrastructure itself.

Once an attacker controls domain-level Group Policy, conventional endpoint detections looking for an encryptor can miss the attack entirely. The persistence and payload effectively live in Active Directory/SYSVOL rather than on individual workstations.

🚨 PAYLOAD RANSOMWARE WEAPONIZES ACTIVE DIRECTORY — NO WINDOWS ENCRYPTOR NEEDED

Kaspersky GERT has disclosed a ransomware incident where attackers turned the victim’s own Active Directory Group Policy infrastructure into the disruptive payload.

• The victim was a manufacturing organization in the Middle East

• Initial access used a compromised valid account through FortiGate SSL VPN

• Attackers obtained domain-admin-equivalent control and created a malicious domain-root GPO named PAYLOAD

• The GPO pushed ransom notes, replaced wallpaper and lock screens, enforced a ransom logon banner and disabled the local administrator account across domain-joined Windows systems

• A second GPO named win Firewall Off disabled Windows Firewall across all profiles

• No Windows files were encrypted and no ransomware binary, endpoint persistence or malicious process was found on affected workstations

• Data was exfiltrated from file servers and other systems and later published on the dark web

• Kaspersky did observe a PAYLOAD ransomware sample targeting ESXi/Linux servers

• The malicious GPO remained effectively dormant until endpoints rebooted, creating roughly a one-day gap between policy creation and visible disruption

This is a notable example of encryptionless ransomware impact delivered through trusted enterprise infrastructure itself.

Once an attacker controls domain-level Group Policy, conventional endpoint detections looking for an encryptor can miss the attack entirely. The persistence and payload effectively live in Active Directory/SYSVOL rather than on individual workstations.