Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

PAYLOAD ransomware group is exploiting domain admin access to weaponize Active Directory GPOs for encryptionless attacks. They're disabling local admin accounts, deploying ransom notes via GPO, and exfiltrating data without dropping binaries or encrypting files. Any org with compromised domain admin credentials is at immediate risk of account lockout and data theft.