Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

www.itsecuritynews.info • September 22, 2026

Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.

This article has been indexed from Securelist

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PAYLOAD Ransomware Exploits Active Directory GPO for Disruption In April 2026, Kaspersky's Global Emergency Response Team (GERT) responded to a ransomware incident at a manufacturing organization in the Middle East. Attackers gained domain-admin-equivalent control via a compromised FortiGate SSL VPN account and created a malicious Group Policy Object (GPO) named PAYLOAD. This GPO disrupted operations by displaying ransom notes, changing desktop wallpapers, enforcing logon banners, and disabling local administrator accounts without encrypting any files. A second GPO, 'win Firewall Off,' disabled the Windows Firewall across all profiles. The attack exemplifies a growing trend of encryptionless ransomware, leveraging trusted Active Directory infrastructure to bypass traditional detection methods. Data exfiltration was also observed, with sensitive information later published on the dark web. No malicious binaries or persistent malware were found on the endpoints, highlighting the need for organizations to enhance their detection strategies focused on Active Directory. 6 sources 71

Extracted Entities

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Ransomware Groups (1)