GROUP POLICY HIJACKED: PAYLOAD RANSOMWARE WEAPONIZES ACTIVE DIRECTORY GPO

# Group Policy Hijacked: PAYLOAD Ransomware Weaponizes Active Directory GPO Without Dropping Malware

In April 2026, Kaspersky's Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East where threat actors gained domain admin-equivalent control and weaponized a malicious Group Policy Object (GPO) named PAYLOAD. Rather than deploying traditional ransomware binaries, the attackers delivered ransom notes, hijacked desktop wallpapers, enforced logon banners, and disabled local administrator accounts across every domain-joined Windows workstation—all without encrypting a single file or leaving malware residue on endpoints. This incident represents a convergence of two critical trends defining the 2026 ransomware landscape: encryptionless extortion and the weaponization of trusted infrastructure.

The attack demonstrates how sophisticated threat actors are increasingly abusing legitimate Active Directory mechanisms to achieve domain-wide impact while completely evading file-based and process-based detection strategies. What makes this case particularly alarming is that the entire attack lived inside Active Directory itself, with no malicious binaries on disk, no endpoint persistence established, and no malicious processes running at the time of forensic analysis.

## Group Policy as an Attack Surface: The Mechanics of Domain-Wide Compromise

Group Policy attacks represent a significant and growing threat vector in modern cybersecurity. A Group Policy Object (GPO) combines a Group Policy Container (GPC) in Active Directory with a Group Policy Template (GPT) stored in SYSVOL, creating a powerful mechanism for centralized configuration management. When attackers link a malicious GPO at the domain root, the policy applies to every computer and user object beneath it, potentially granting complete control over the entire corporate network.

What makes GPO abuse particularly dangerous in cybersecurity incidents is that group policies process in a trusted, high-privilege environment, ensuring persistence because endpoint cleanup alone cannot remove them. This attack technique has been repeatedly documented in ransomware operations. Microsoft observed Ryuk operators distributing ransomware through Group Policy and SYSVOL startup items, while LockBit affiliates modified SYSVOL Group Policy files including ScheduledTasks.xml to support ransomware execution and propagation. BlackCat/ALPHV operators have also abused GPOs to create scheduled tasks and deploy ransomware across compromised networks.

## The Attack Chain: Reconstructing the PAYLOAD GPO Compromise

During the April 2026 investigation, Kaspersky GERT successfully reconstructed the attack timeline, beginning with a compromised valid account (MITRE ATT&CK T1078) used to authenticate through the organization's FortiGate SSL VPN—an external remote service (T1133). Insufficient logging on the FortiGate appliance prevented investigators from determining exactly how the credential was initially compromised, though three hypotheses were considered plausible.

Once inside the internal network, the threat actor operated with the compromised account's privileges. Because the account could create and link a GPO at the domain root, it held either domain admin privileges or delegated equivalent access, such as membership in Group Policy Creator Owners combined with link rights on the domain object. Insufficient authentication logs and virtualization privilege escalation logs prevented reconstruction of the lateral movement and privilege escalation chain between initial VPN access and GPO write privilege level. Common real-world routes to GPO control—including DCSync, Kerberoasting of privileged service accounts, and Pass-the-Hash/Pass-the-Ticket attacks—could not be confirmed or ruled out.

## The Malicious GPO Infrastructure: PAYLOAD and "win Firewall Off"

The offensive toolkit consisted of two GPOs that together comprised the entire attack infrastructure. A Resultant Set of Policy (RSOP) analysis allowed investigators to list all policy settings on affected workstations and reconstruct the changes delivered by the PAYLOAD GPO. This object enabled desktop wallpaper and lock screen hijacking, distributed ransom notes across all domain-joined systems, enforced a malicious logon banner, and disabled the local administrator account across the entire domain environment.

The second domain-root-linked GPO, named "win Firewall Off," disabled Windows Firewall across all domain, private, and public profiles on endpoints (T1562.004). Deployed independently of PAYLOAD, this object degraded host defenses and ensured the actor retained unimpeded network reach to endpoints for any follow-on activity. Both GPOs worked in concert to maximize impact while minimizing detection opportunities.

## The Dormant Threat: Delayed Policy Application Complicates Forensics

One of the most forensically instructive details in this cybersecurity investigation was the one-day gap between GPO creation on April 13 and visible impact on April 14. Analysis of Master File Table timestamps and the Group Policy History registry key confirmed the policy was written to SYSVOL and cached on endpoints on April 13. However, computer configuration settings such as wallpaper and lock screen machine policy, security settings, and firewall disabling only apply upon reboot or policy refresh—and no endpoint had rebooted in the interim. The attack remained dormant in the GPO cache for one day before detonating en masse when machines restarted according to standard procedures.

This delayed policy application characteristic of GPO-based operations creates two significant consequences for defenders. First, it may grant attackers a quiet window for exfiltration, persistence, or further staging between weaponization and impact. Second, it can sever the temporal link between the cause (a GPO-creation event in the directory log) and the effect (mass user-visible disruption occurring at a later time), complicating timeline reconstruction unless directory service auditing is in place.

## Beyond Endpoint Detection: The Persistence Mechanism and Telemetry Sources

The attack's persistence mechanism is the GPO link itself on the domain controller, with no endpoint-resident component whatsoever. Because no malicious binary or process exists, effective detection logic must focus on directory service and SYSVOL indicators. A gPLink modification at the domain root by a non-standard account represents one of the most telling indicators of this attack class, making Active Directory change auditing essential.

The Windows endpoint attack described in this report was implemented entirely through malicious Group Policy Objects and did not involve a recovered ransomware executable, resident endpoint malware, confirmed file encryption, or active malicious processes at the time of forensic examination. However, PAYLOAD cryptomalware for Windows does exist, and public analysis of its samples reveals additional malicious capabilities that could enrich detection logic and security policies for organizations facing similar threats.

## PAYLOAD Ransomware Family Capabilities: What Public Analysis Reveals

Public reverse engineering of the PAYLOAD Windows variant reveals an optional event log clearing capability (T1685.005, formerly T1070.001). The ransomware dynamically resolves Windows Event Log APIs, enumerates available event log channels, and clears individual channels. This behavior reduces the availability of records related to process execution, authentication, PowerShell, service control, and system changes, though it does not necessarily remove events already forwarded to a SIEM, Windows Event Collector, EDR backend, or protected log archive.

Event ID 1102 should be correlated with aggravating factors including domain admin account activity, GPO modifications, SYSVOL file changes, and VPN authentication anomalies. Notably, the absence of Event ID 1102 does not prove log clearing did not occur—direct deletion, truncation, service impairment, or incomplete audit configuration may produce different evidence. The PAYLOAD Windows variant also contains logic targeting security processes and services (T1685 and T1489), intended to stop security products, backup software, database services, and applications that may lock files targeted for encryption.

## The Broader Ransomware Ecosystem: Relevant Techniques and Risks

While not conclusively attributed to this incident, several techniques remain relevant risks in the ransomware ecosystem. Event Tracing for Windows (ETW) patching inside ransomware processes can reduce telemetry generated by the modified process, though telemetry gaps are not conclusive evidence of ETW patching without memory acquisition. Bring Your Own Vulnerable Driver (BYOVD) attacks involve introducing or abusing a legitimately signed but vulnerable kernel driver to gain kernel-level capabilities, though public PAYLOAD analyses do not provide sufficient evidence to conclude BYOVD is an intrinsic capability.

Ransomware operators increasingly target ESXi and vCenter because compromising the virtualization layer provides access to many business-critical virtual machines. On the target organization's Linux servers, investigators observed an ESXi PAYLOAD variant, making this behavior operationally relevant. However, the reviewed evidence does not indicate PAYLOAD operators used policy-weakening actions in the investigated incident.

## Remediation Strategy: A Four-Phase Approach to Contain and Recover

Effective remediation requires a comprehensive approach. Phase 1 involves immediate domain controller actions, prioritizing removal of the source GPOs—endpoint cleanup is ineffective until this occurs because the next policy refresh re-infects cleaned machines. Phase 2 focuses on Active Directory and GPO hardening, while Phase 3 addresses credential and access hardening. Phase 4 establishes detection and monitoring capabilities to identify similar attacks in the future.

## Conclusion: The Cybersecurity Implications of Encryptionless Extortion

PAYLOAD demonstrates a maturing tactic of turning the victim's own trusted infrastructure into a weapon. By weaponizing Group Policy, the actor achieved domain-wide impact without a single malicious binary on any endpoint, evaded file- and process-based detection entirely, and caused organization-wide disruption within seconds of the first reboot. The absence of encryption is the most strategically significant finding, consistent with the 2026 trend toward encryptionless extortion. Kaspersky GERT assesses with moderate confidence that missing encryption reflects either a deliberate decision to stay below the irreversible data destruction threshold while preserving follow-on encryption options, or an operation interrupted before full execution.

This incident proves that a threat actor with domain admin access and working knowledge of group policy internals can inflict domain-wide disruption equivalent to a ransomware attack without writing a single malicious file to any endpoint. Detection strategies anchored solely in file- or process-based indicators are blind to this attack class. Effective controls include directory service change auditing, SYSVOL integrity monitoring, and privileged access governance. Organizations protecting against modern ransomware must recognize that the most dangerous attacks may not look like malware at all—they may simply look like configuration changes flowing through trusted infrastructure.