Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
PAYLOAD ransomware group uses Active Directory GPO for encryptionless attacks.
Kaspersky GERT analyzed a manufacturing organization incident where the PAYLOAD ransomware group leveraged Active Directory Group Policy Objects (GPOs) for an encryptionless attack. The threat actor gained domain admin control, created a malicious GPO to deliver ransom notes, alter desktop backgrounds, and disable local administrator accounts without deploying any binaries or encrypting data on Windows machines. The attack also involved data exfiltration and targeting ESXi servers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Active Directory?
Get an email when a new story names Active Directory, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe PAYLOAD ransomware group exploited domain administrator-level privileges to manipulate Active Directory Group Policy Objects, enabling a widespread attack without deploying a single malicious binary or encrypting files. By abusing a legitimate Windows management mechanism, the threat actor delivered ransom notes, altered desktop backgrounds, and disabled local administrator accounts across the organization's Windows estate. This 'living-off-the-land' approach bypasses traditional endpoint detection tools that focus on malicious executables or encryption activity. The attack highlights the catastrophic blast radius when privileged AD credentials are compromised and GPO changes go unmonitored. It also demonstrates that ransomware extortion no longer requires encryption — data exfiltration and operational disruption alone can be sufficient leverage.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — PAYLOAD