Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Summary

Kaspersky GERT analyzed a manufacturing organization incident where the PAYLOAD ransomware group leveraged Active Directory Group Policy Objects (GPOs) for an encryptionless attack. The threat actor gained domain admin control, created a malicious GPO to deliver ransom notes, alter desktop backgrounds, and disable local administrator accounts without deploying any binaries or encrypting data on Windows machines. The attack also involved data exfiltration and targeting ESXi servers.

Full text

Threat Response Table of Contents Executive summaryGroup Policy as an attack surfaceAttack timelineIncident overviewInitial accessExecutionThe PAYLOAD GPOThe win Firewall Off GPOThe one-day delay detonationForensic findingsDetection engineeringAnti-forensics and recovery-inhibition capabilitiesConfirmed PAYLOAD family capabilitiesWindows Event Log clearingForensic indicatorsSecurity process and service terminationForensic indicatorsVSS deletion, backup and recovery suppressionForensic indicatorsEcosystem-relevant ransomware techniquesETW suppression and in-memory patchingForensic indicatorsVulnerable signed driver abuse, BYOVDForensic indicatorsESXi security policy weakeningForensic indicatorsRemediationPhase 1 — domain controller actions (to be performed first)Phase 2 — Active Directory and GPO hardeningPhase 3 — credential and access hardeningPhase 4 — detection and monitoringConclusionDetection by Kaspersky solutionsMITRE ATT&CK mappingIndicators of compromise Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root. Through that single object, the actor delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data. The only ransomware we found in this incident was PAYLOAD sample targeting ESXi on Linux servers. Besides that, data exfiltration was observed originating from the file servers and several additional systems, and was later published on the dark web. This case is an example of two converging trends that define the 2026 ransomware landscape: Living-off-the-land abuse of trusted AD infrastructure. Group Policy is a signed, allowlisted, SYSTEM-privileged distribution channel that the majority of endpoint detection and response tools is designed not to inspect. By delivering impact through GPO rather than through malware, the actor sidestepped the entire file- and process-based detection stack. Encryptionless extortion. Industry telemetry shows extortion-only incidents grow significantly year-on-year. PAYLOAD fits this model; the leverage is operational disruption and the threat of escalation rather than cryptographic denial of data. We confirmed that no files were encrypted on Windows machines, no malicious binaries were resident on disk, no endpoint persistence was established, and no malicious processes were running at the time of analysis. The entire attack lived inside Active Directory itself. The defensive implication is stark: an organization whose detection strategy depends on catching a ransomware executable would have seen nothing until the first endpoint rebooted and the ransom wallpaper appeared. In this article, we will describe the GPO attack chain and provide operational advice on how to detect such threats, including detailed remediation recommendations. Group Policy as an attack surface Attacks through group policies are nothing new. They can inflict significant, domain-wide damage with multiple malicious capabilities. A Group Policy Object (GPO) is essentially a combination of a Group Policy Container (GPC) in Active Directory and a Group Policy Template (GPT) in SYSVOL. The Group Policy scope depends on whether the GPC is linked to the directory tree at the domain, site, or organization unit (OU) level. A link at the domain root means the policy applies to every computer and user object beneath it. Thus, a GPO compromised at the domain root can affect all in-scope domain users and computers, potentially granting an attacker complete control over the corporate network. What makes GPO abuse even more dangerous is that group policies are processed in a trusted, high-privilege environment, ensuring persistence because endpoint cleanup is not enough to remove them. We have already discussed GPO architecture and ways it can be compromised in greater detail in an earlier blog post. Other public threat intelligence has also repeatedly documented this technique in ransomware operations. Microsoft observed Ryuk operators distributing ransomware through Group Policy, SYSVOL startup items, and PsExec. LockBit affiliates have been documented modifying SYSVOL Group Policy files, including ScheduledTasks.xml, to support ransomware execution and propagation. BlackCat/ALPHV operators have also abused GPOs to create scheduled tasks and deploy ransomware. Another notable example of GPO abuse is PAYLOAD ransomware, which weaponizes GPO Preferences and policy settings for pure impact rather than as a launcher for an encryptor. Let’s take a closer look at this attack, which is detailed further below. Attack timeline During the April 2026 investigation, we managed to reconstruct the attack timeline as outlined below: Date Event 11 April Initial access. Threat actor authenticates to the FortiGate SSL VPN using a valid but compromised domain credential. 13 April GPO authored. Malicious GPO, PAYLOAD ({C897F2C7-C2AC-4E6F-BF48-58036FF29E79}) created and linked at the domain root, configuring ransom notes, wallpaper, lock screen, logon banner, and administrator account disablement. 13 April SYSVOL staging. The payload.jpg and hello.txt files written to \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\. 13 April Second GPO. GPO named win Firewall Off ({22099AD2-E062-4F56-B574-5099BBA4E7A6}) linked at the domain root, disabling Windows Firewall on all profiles. 13 April Dormancy. GPO cached on endpoints but computer configuration not yet applied — no endpoint had rebooted since the policy update. 13 April Data exfiltration. Data exfiltration was observed originating from the file servers and several additional systems. 14 April Detonation. Most of the endpoints begin rebooting; computer configuration policies apply. Ransom wallpaper, logon banner, and notes appear. Operational disruption begins. 15 April Response. Kaspersky GERT engaged. Forensic triage of affected workstations and the domain controller initiated. 16 April Assessment. GERT confirms no file encryption, no resident malware, no endpoint persistence. Next, we will discuss each of these stages in more detail and share the findings from our incident response activities. Incident overview Initial access The entry vector was a compromised valid account (MITRE ATT&CK T1078) used to authenticate through the organization’s FortiGate SSL VPN — an external remote service (T1133). Insufficient logging on the FortiGate appliance prevented us from reconstructing how the credential was originally compromised. Three hypotheses were considered plausible in the context of the attack, in no particular order: Password spraying or credential stuffing against the SSL VPN portal. Phishing-led credential harvesting. Purchase of pre-compromised credentials from an initial access broker (IAB). Once on the internal network, the actor operated with the compromised security principal’s privileges. Because the account was able to create and link a GPO at the domain root, it held either domain admin privileges or a delegated equivalent (e.g., membership of Group Policy Creator Owners combined with link rights on the domain object). FortiGate SSL VPN authentication logs and ESXi/virtualization privilege escalation logs were insufficient to reconstruct the lateral movement and privilege escalation chain between initial VPN access and the GPO write privilege level. The most common real-world routes to GPO control — DCSync, Kerberoasting of privileged service accounts, and Pass-the-Hash/Pass-the-Ticket — could not be confirmed or ruled out. Execution Rather than deploying an encryptor, the actor abused the victim’s Ac

Indicators of Compromise

• malware — PAYLOAD

Entities