PAYLOAD Ransomware Abuses Active Directory Group Policy for Domain-Wide Disruption
The PAYLOAD ransomware group is weaponizing Active Directory Group Policy Objects (GPOs) to deliver ransom notes and disrupt operations without deploying traditional ransomware binaries.
The PAYLOAD ransomware group has adopted a novel and insidious attack vector, leveraging Active Directory Group Policy Objects (GPOs) to orchestrate domain-wide disruptions without relying on traditional ransomware encryption. In an incident investigated by Kaspersky's Global Emergency Response Team (GERT) in April 2026, threat actors gained domain administrator-equivalent control and created a malicious GPO named "PAYLOAD." This single object was then linked at the domain root, allowing the attackers to disseminate ransom notes, hijack desktop wallpapers and lock screens, enforce logon banners, and disable local administrator accounts across all domain-joined Windows workstations.
This attack method bypasses many standard security controls because GPOs are a trusted, system-privileged distribution channel that endpoint detection and response (EDR) solutions are often configured not to inspect deeply. By delivering impact directly through the GPO mechanism rather than dropping malicious files or executing processes, the attackers sidestepped the typical file and process-based detection stack. This approach aligns with a growing trend in the ransomware landscape towards encryptionless extortion, where the primary leverage comes from operational disruption and the threat of data exfiltration or escalation, rather than the cryptographic denial of access to data.
Kaspersky confirmed that no files were encrypted on the affected Windows machines, no malicious binaries were found on disk, and no endpoint persistence mechanisms were established. The entire attack resided within the Active Directory infrastructure itself. This highlights a significant defensive gap: organizations relying solely on detecting ransomware executables would have remained unaware of the compromise until endpoints rebooted and the malicious wallpaper appeared, signaling the operational disruption.
Group Policy, a core component of Active Directory, allows administrators to manage user and computer settings across a network. A GPO consists of a Group Policy Container in Active Directory and a Group Policy Template in SYSVOL. When a GPO is linked at the domain root, its settings apply to all computers and users within that domain. This makes a compromised GPO at this level a potent tool for attackers, granting them extensive control over the corporate network. The inherent trust and high privilege associated with GPO processing make them particularly dangerous, as simply cleaning endpoints may not remove the policy's effects.
This technique is not entirely new, with other ransomware groups like Ryuk, LockBit, and BlackCat/ALPHV previously documented abusing GPOs for various malicious purposes, including distributing ransomware, modifying scheduled tasks, and deploying malware. However, PAYLOAD's specific focus on using GPO Preferences and policy settings for pure impact—disruption and extortion—rather than solely as a delivery mechanism for an encryptor, marks a notable evolution in their tactics.
The attack timeline reconstructed by GERT shows a methodical progression. Initial access was gained on April 11th via a compromised domain credential used to authenticate through a FortiGate SSL VPN. Two days later, the malicious "PAYLOAD" GPO was authored and linked, alongside another GPO disabling the Windows Firewall. The necessary ransom notes and wallpaper files were staged in SYSVOL. While the GPOs were cached on endpoints, the full impact was delayed until April 14th, when most machines rebooted, applying the GPO configurations and initiating the operational disruption. Data exfiltration was also observed during this period from file servers and other systems.
In addition to the GPO-based disruption on Windows systems, the PAYLOAD group also deployed an ESXi encryptor targeting Linux servers and exfiltrated data, which was subsequently published on the dark web. This dual approach—leveraging AD infrastructure for disruption and deploying traditional encryption on servers—demonstrates a versatile and comprehensive extortion strategy. The incident underscores the critical need for organizations to bolster their Active Directory security, implement robust logging and monitoring, and extend detection capabilities beyond traditional file and process-based methods to include the configuration and policy layers.
Defensive recommendations include regularly auditing GPO configurations, monitoring SYSVOL for unauthorized changes, implementing least privilege principles for domain accounts, and ensuring comprehensive logging for authentication events and GPO modifications. Organizations should also consider specialized tools that can detect living-off-the-land techniques and monitor for unusual policy application events. The PAYLOAD group's tactics serve as a stark warning about the evolving threat landscape and the importance of securing the foundational elements of enterprise IT infrastructure.
This new report details the specific attack vector used by PAYLOAD ransomware, which involved compromising a FortiGate SSL VPN to gain initial access with stolen credentials. The attackers then leveraged these credentials to deploy a malicious Group Policy Object (GPO) that disrupted the domain by displaying ransom demands, disabling firewalls, and locking administrator accounts, all without encrypting files. Kaspersky's analysis highlights that the attack lived entirely within Active Directory, bypassing traditional endpoint defenses, and recommends monitoring SYSVOL integrity and specific GPO-related event IDs for detection.