GPO Manipulation - MITRE ATT&CK

Threat entity extracted from intelligence sources

Frequency
1
occurrences
First Seen
December 16, 2025
Last Seen
December 16, 2025

GPO Manipulation refers to adversaries modifying Group Policy Objects within an Active Directory environment to deploy malicious configurations, startup scripts, or registry changes across domain-joined hosts.

GPO Manipulation is a mitre_attack tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed December 16, 2025; most recent activity December 16, 2025.

Overview

GPO Manipulation refers to adversaries modifying Group Policy Objects within an Active Directory environment to deploy malicious configurations, startup scripts, or registry changes across domain-joined hosts. This technique enables persistent, domain-wide control, facilitating stealthy lateral movement and defense evasion. It is significant because a single compromised domain controller can influence many endpoints, making it a powerful and risky method for attackers, including ransomware operators.

Related Threat Clusters

Recent Intelligence Reports

  • ASEC warns of expanding Gentlemen ransomware campaigns hitting manufacturing and healthcare — Industrialcyber.Co · December 16, 2025

Frequently asked questions

What is GPO Manipulation?

GPO Manipulation refers to adversaries modifying Group Policy Objects within an Active Directory environment to deploy malicious configurations, startup scripts, or registry changes across domain-joined hosts.

Is GPO Manipulation still active?

The most recent intelligence report mentioning GPO Manipulation on ThreatCluster is dated December 16, 2025.

What is GPO Manipulation associated with?

Across ThreatCluster reporting, GPO Manipulation most frequently co-occurs with Ransomware, Construction, Healthcare, Insurance, Manufacturing, among 12 tracked related entities.

What are the latest developments involving GPO Manipulation?

The most significant recent cluster is “Gentlemen Ransomware Targets Global Industries Amid LLM Integration” (26 articles · Updated December 17, 2025). GPO Manipulation appears across 1 threat cluster in total, listed above with sources.

How much reporting does ThreatCluster have on GPO Manipulation?

GPO Manipulation appears in 1 intelligence report mention across 1 deduplicated threat cluster, aggregated from 17,000+ monitored sources.

CVSS v3.1 Breakdown