PAYLOAD Ransomware Hijacks Active Directory Group Policy for Encryptionless Extortion

Severity

High

Detail

Researchers from Kaspersky’s Global Emergency Response Team have analyzed a ransomware operation known as PAYLOAD, which demonstrates a shift toward encryptionless extortion by abusing Microsoft Active Directory Group Policy Objects (GPOs) instead of deploying traditional ransomware encryptors.

The incident, observed in April 2026 at a manufacturing organization in the Middle East, involved attackers obtaining domain administrator-equivalent privileges and creating malicious GPOs that impacted all domain-joined systems. Rather than encrypting files, the attackers leveraged trusted Windows management mechanisms to distribute ransom messages, disable security controls, and disrupt business operations across the enterprise.

The attack combined operational disruption with data theft that allow the threat actor to pressure victims through extortion while avoiding many traditional ransomware detection mechanisms. Investigators confirmed that stolen data was later published on a dark web leak site, indicating the use of a double-extortion strategy. The campaign highlights how attackers can achieve ransomware-level impact by compromising Active Directory infrastructure and abusing legitimate administrative tools without deploying malware on endpoints.

How?

The attack began on April 11, 2026, when the threat actor gained access through a FortiGate SSL VPN using compromised domain credentials. Investigators were unable to determine whether the credentials were obtained through phishing, password spraying, credential stuffing, or an initial access broker. After obtaining privileged access, the attackers created a malicious Group Policy Object named PAYLOAD and linked it directly to the Active Directory domain root, allowing the policy to affect all in-scope users and systems across the environment.

The malicious GPO distributed ransom notes to user desktops and local drive roots, replaced desktop wallpapers and lock screens with ransom messages, configured a Windows logon banner displaying extortion demands, and disabled the built-in local Administrator account.

A second malicious GPO named “win Firewall Off” was created to disable Windows Firewall across domain, private, and public network profiles, weakening security controls throughout the environment. The attackers staged files including payload.jpg and hello.txt in the domain controller’s SYSVOL share. These files were subsequently distributed through Group Policy, with the ransom note copied to affected systems as README-payload.txt.

Notably, investigators found no encrypted files, ransomware executables, malicious services, scheduled tasks, or active malicious processes on affected endpoints. Instead, the GPO itself acted as the attack mechanism and persistence method, leveraging trusted Active Directory and SYSVOL infrastructure to propagate changes across the domain.

The visible impact occurred approximately one day after the malicious GPO deployment when endpoints rebooted and applied updated Group Policy settings. This delay provided attackers additional time to conduct data exfiltration and complicated forensic investigations.

Indicator of Compromise (IoC)

Type	Indicator	Description
Malicious GPO	{C897F2C7-C2AC-4E6F-BF48-58036FF29E79}	PAYLOAD ransomware GPO linked at the Active Directory domain root
Malicious GPO	{22099AD2-E062-4F56-B574-5099BBA4E7A6}	“win Firewall Off” GPO used to disable Windows Firewall
SYSVOL File	payload[.]jpg	Ransom wallpaper and lock-screen image distributed through Group Policy
SYSVOL File	hello[.]txt	Source ransom note stored in SYSVOL
Dropped File	README-payload[.]txt	Ransom note copied to desktops and drive roots
MD5	0108656A3E1ADE6CA4F21B084F5E1208	killer[.]exe process-killing tool
MD5	BEA5E267F24D7DA59F6821BFFDBFF293	kill[.]exe process-killing tool
Registry Value	HKLM…\Policies\System\legalnoticecaption = Welcome to Payload!	Logon banner deployed through the PAYLOAD GPO

Conclusion

The PAYLOAD operation demonstrates how threat actors can achieve widespread disruption and extortion without deploying traditional ransomware encryption tools. By abusing Active Directory Group Policy infrastructure, the attackers were able to distribute ransom messages, weaken security controls, disable administrative access, and impact the entire Windows domain through trusted management mechanisms.

The attack also highlights the critical importance of protecting privileged Active Directory accounts and monitoring Group Policy changes. Organizations should closely monitor unauthorized GPO creation, domain-root GPO links, SYSVOL modifications, firewall policy changes, and unusual Active Directory events. Regular auditing of administrative privileges, strong MFA enforcement for remote access services, and enhanced monitoring of domain controllers can help reduce the risk of similar attacks.

Source

https://cyberpress.org/payload-ransomware-hijacks-active-directory-group-policy/