PAYLOAD Ransomware Exploits Active Directory for Disruption

• •Attackers exploited Active Directory Group Policy to deliver ransom notes without encryption.
• •No malware was found on workstations, highlighting a new method of ransomware delivery.
• •Data exfiltration occurred, with sensitive information published on the dark web.

In April 2026, Kaspersky's Global Emergency Response Team responded to a ransomware incident at a manufacturing organization in the Middle East. Attackers gained domain-admin-equivalent control through a compromised account and created a malicious Group Policy Object (GPO) named PAYLOAD at the domain root. This GPO pushed ransom notes, altered desktop wallpapers, enforced a ransom logon banner, and disabled local administrator accounts across all domain-joined Windows systems, all without encrypting files or deploying malware. A second GPO disabled Windows Firewall. Data exfiltration occurred, with sensitive information later published on the dark web. The attack exemplifies a trend of encryptionless extortion, leveraging trusted enterprise infrastructure for operational disruption. No malicious binaries or processes were found on affected workstations, indicating a novel attack vector that evades traditional detection methods.