PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain ...

PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain

A ransomware incident in which attackers used Active Directory Group Policy to disrupt operations without deploying a Windows encryptor or leaving malware running on endpoints. In April 2026, the attackers accessed a FortiGate SSL VPN using compromised domain credentials, then gained domain-admin-equivalent rights. PAYLOAD Ransomware On April 13, Kaspersky’s Global Emergency Response Team (GERT) created

PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain Without Encryption

A PAYLOAD ransomware attack used Active Directory Group Policy Objects to disrupt an entire Windows domain without encrypting files or deploying ransomware binaries. The operation targeted a manufacturing organization in the Middle East. It relied on domain-level control, stolen credentials, and malicious GPOs to display ransom demands, disable defenses, and lock down administrator access. In […]

Kaspersky Unveils New 'Payload' - Stealth Ransomware That Takes Control of Corporate Devices Without Encrypting Files

New Kaspersky report points to growing trend of "extortion without encryption" Kaspersky's Global Emergency Response Team (GERT) has published a new report analyzing sophisticated new tactics within the Payload ransomware family. The attack was discovered during a security incident response at a manufacturing company in the Middle East and indicates [...]

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

PAYLOAD ransomware attacks through Active Directory GPO | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware - National Cyber Security Consulting

Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root. […] Thank you for subscribing to our RSS feed!

PAYLOAD ransomware attacks through Active Directory GPO

Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root. Through that single object, the actor delivered ransom notes, hijacke…

There is no tracked Bias information for the sources covering this story.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage