PAYLOAD Ransomware Turns Active Directory Group Policy Into a Domain-Wide Weapon
PAYLOAD Ransomware Turns Active Directory Group Policy Into a Domain-Wide Weapon
Ransomware operators do not need to deploy an encryptor to create a business-wide crisis. A new incident analyzed by Kaspersky shows how attackers used compromised administrative access and Active Directory Group Policy Objects (GPOs) to disrupt a manufacturing organization across its Windows domain.
The case is a warning for every organization that still treats ransomware detection as primarily a file-scanning problem. The attackers created a malicious GPO named PAYLOAD and linked it at the domain root. That trusted administrative mechanism changed endpoint behavior at scale: ransom messaging appeared, wallpapers and lock screens were replaced, and local administrator access was disabled. A second policy disabled Windows Firewall. No Windows ransomware binary had to be present on the affected workstations.
Kaspersky’s Global Emergency Response Team investigated the incident after the attackers had gained domain administrator-equivalent control. The initial path was not confirmed, but the investigation identified a compromised account used through a FortiGate SSL VPN. That sequence matters: a valid account, privileged directory access, and a legitimate Windows management feature were enough to turn the organization’s own configuration system into the delivery layer.
Why the absence of encryption is misleading
The incident did not fit the familiar ransomware picture. Investigators found no encrypted files, no resident encryptor, no malicious endpoint persistence, and no active malicious process at the time of examination. Yet the organization still faced domain-wide disruption and data-extortion pressure. Data exfiltration was also observed from file servers and other systems, with stolen information later published.
This is living-off-the-land behavior applied to identity and administration rather than a command shell. The attacker used a trusted control plane that security teams normally rely on. A GPO linked to the domain root can affect every in-scope domain user and computer, so a single unauthorized change can have a much larger blast radius than an endpoint malware infection.
The practical lesson is simple: “we found no encryptor” is not the same as “we found no ransomware impact.” A compromised Active Directory environment can be the persistence mechanism, the distribution channel, and the source of operational disruption at the same time.
What defenders should hunt
The first priority is to make high-impact directory changes visible and attributable. Security teams should monitor for:
- new or modified GPOs, especially those linked at the domain root or broad organizational units;
- unexpected changes inside SYSVOL, including new images, scripts, scheduled-task settings, or security templates;
- changes to GPO ownership, permissions, delegation, or link order;
- edits to policies that disable Windows Firewall, alter local administrator membership, or change logon and lock-screen settings;
- privileged VPN sign-ins followed by directory administration from an unusual device, location, or time;
- bursts of policy processing and reboots across many endpoints after a privileged account event.
These signals belong in threat intelligence and incident response workflows, not only in a Windows endpoint alert queue. Collect and retain domain-controller security logs, directory-service change events, SYSVOL file-integrity telemetry, VPN authentication records, and endpoint policy-processing events. Without that join-up, a malicious policy change can look like routine administration on every individual machine.
Reduce the blast radius before an incident
Organizations should restrict who can create, edit, and link GPOs, separate policy administration from ordinary domain administration, and require strong phishing-resistant MFA for VPN and privileged access. Review whether service accounts or delegated groups can modify policies beyond their operational need. Treat domain-root linking as a high-risk action that requires change control and an independent approval path.
Maintain known-good exports or backups of GPOs and SYSVOL, but do not assume that restoring an endpoint image repairs the directory. During containment, responders need to identify and disable malicious links, preserve the affected policy objects and directory evidence, restore trusted policy state, and rotate credentials that may have been exposed. They should also validate firewall settings, local administrator state, and security-tool configuration after policy recovery.
The PAYLOAD case reinforces a broader shift in extortion operations: disruption and stolen data can provide leverage even when files remain readable. Defenders that measure ransomware readiness only by encryptor prevention will miss the control-plane attack already sitting inside the domain. Monitor the policies that govern the estate, protect the identities allowed to change them, and practice recovery from a compromised directory—not only recovery from encrypted disks.
References
FAQ
Ransomware operators do not need to deploy an encryptor to create a business-wide crisis. A new incident analyzed by Kaspersky shows how attackers used compromised administrative access and Active Directory Group Policy Objects (GPOs) to disrupt a manufacturing organization across its Windows domain.