PAYLOAD: A Malicious GPO Replaces Ransomware on Windows

Between April 11 and 16, 2026, Kaspersky's GERT responded to an incident at a Middle Eastern manufacturing organization where a threat actor delivered domain-wide ransomware impact without leaving a single malicious binary on Windows workstations. The vector was a malicious Group Policy Object (GPO) created with domain administrator privileges: the very infrastructure that manages corporate policy became the payload.

The GPO as Payload: Anatomy of a No-Endpoint-Malware Attack

Forensic analysis by Kaspersky GERT reconstructs a precise timeline. On April 11, 2026, the actor gained access via FortiGate SSL VPN using compromised domain credentials. Two days later, on April 13, they created the "PAYLOAD" GPO and linked it to the domain root: this object configured five actions distributed to all target computers through the SYSVOL channel.

According to the documented RSOP (Resultant Set of Policy) analysis, the GPO abuses legitimate Client-Side Extensions: the Files CSE drops README-payload.txt on workstations, the Registry CSE modifies legalnoticecaption and legalnoticetext values, the Personalization and Desktop policies set wallpaper and lock screen with ransom images pulled from SYSVOL, while Security Settings via GptTmpl.inf disables the local Administrator account. A second GPO, "win Firewall Off," removes firewall protection across all network profiles.

Detonation occurs on April 14 with endpoint reboots: upon restart, policies apply and ransom messages appear. Until that moment, no EDR tool could have detected anomalies: "Group Policy is a signed, allowlisted, SYSTEM-privileged distribution channel that the majority of endpoint detection and response tools is designed not to inspect," as the GERT team reports. The entire attack lived inside Active Directory itself.

Encryptionless and the Failure of File-Centric Defenses

The GERT report explicitly confirms that no ransomware sample was found on Windows systems: no encrypted files, no malicious binaries, no endpoint persistence. The only ransomware identified is a PAYLOAD sample targeting ESXi on Linux servers. The extortion model therefore relies exclusively on publishing exfiltrated data on the dark web and the psychological-operational impact of the GPO, not on encryption.

This approach aligns with a macro trend identified by Symantec: 6,182 extortion attacks in 2025, a 23% increase over 2024, where groups like Snakefly/Cl0p and ShinyHunters pioneered the encryptionless model. According to Kaspersky, only 28% of victims paid the ransom in 2025, pushing operators to seek methods with lower operational costs and greater reputational pressure.

The operational consequence is immediate: an organization whose detection strategy depends on intercepting a ransomware executable would have seen nothing until the first endpoint reboot and the appearance of the ransom wallpaper. Endpoint-centric defenses — EDR, antivirus, execution prevention — were completely bypassed because the attack did not cross the endpoint layer in a detectable way.

What to Do Now

Priority actions derive directly from GERT report evidence and related research on GPO abuse:

• Monitor Event 5136 on Domain Controllers: GPO modification, creation, or deletion must trigger an alert correlated with expected administrative activity. The GERT report identifies this event as the primary source of forensic visibility.
• Implement SYSVOL logging to detect unauthorized file staging: the PAYLOAD GPO pulled wallpapers and ransom notes from the SYSVOL share, a typically trusted and uninspected channel.
• Adopt AD-centric detection that tracks changes to GPO links at the domain root and anomalies in policy application on unusually short timescales. Kaspersky research on SharpGPOAbuse and GPOddity provides behavioral indicators for these scenarios.
• Reassess the backup-recovery assumption: in the encryptionless model, backups are not the first line of defense. Impact is compliance and reputational; mitigation requires protecting Active Directory integrity and exfiltrated data, not just availability.

Detection and Investigation Limits

The GERT report leaves significant open questions about the attacker's internal path. The exact method of VPN credential compromise is not documented: the team presents three hypotheses — password spraying, credential stuffing, or purchase from an Initial Access Broker — but does not distinguish them with forensic evidence. Similarly, the lateral movement and privilege escalation path between VPN access and GPO control is not reconstructed in detail.

No infrastructure overlaps emerge linking the actor to known groups at this time: attribution remains unconfirmed. The report does not specify the victim organization's size, the exact number of affected endpoints, the ransom amount demanded, or any payments made.

The PAYLOAD methodology is not entirely novel: Ryuk, LockBit, and BlackCat/ALPHV previously abused GPO to deploy traditional ransomware. The novelty lies in eliminating the malware deployment phase: the GPO itself becomes the entire payload, exploiting the SYSTEM-privileged trust boundary and the absence of EDR inspection on native AD channels.

"By delivering impact through GPO rather than through malware, the actor sidestepped the entire file- and process-based detection stack" — Kaspersky GERT

Why the Defense Perimeter Shifts to Active Directory

The PAYLOAD incident confirms a trajectory already observed: when IT management infrastructure becomes the attacker's weapon, the defense perimeter inevitably shifts from the individual endpoint to control of identity and centralized configuration. Organizations investing in advanced EDR but neglecting Active Directory monitoring operate on an obsolete security assumption: that malware must necessarily touch disk to cause damage.

The GERT-documented case proves the opposite. The next generation of enterprise attacks does not try to evade EDR: it simply never shows up in front of it.

Sources

• https://securelist.com/tr/payload-ransomware-via-group-policy/121335/
• https://www.security.com/threat-intelligence/ransomware-extortion-epidemic
• https://securelist.com/state-of-ransomware-in-2026/119761/
• https://securelist.com/group-policies-in-cyberattacks/115331/
• https://www.microsoft.com/en-us/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
• https://www.kaspersky.com/blog/ransomware-group-policies/40877/

Information verified against cited sources and current as of publication.

Sources