Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

In April 2026, Kaspersky GERT responded to an incident at a Middle Eastern manufacturing organization where threat actors leveraged domain admin privileges to create malicious Group Policy Objects (GPOs) in Active Directory. The PAYLOAD GPO was used to deface endpoints with ransom notes, disable the local administrator account, and change wallpapers and lock screens without deploying any ransomware binary or encrypting files. A second GPO disabled Windows Firewall across the domain. Data exfiltration was observed, and the attack remained dormant until endpoints rebooted. The actors used living-off-the-land techniques to evade traditional detection, demonstrating an encryptionless extortion model.

AI-extracted · verify before operational use