PAYLOAD: The Ransomware That Turned Active Directory Itself Into a Weapon

On April 14, 2026, hundreds of workstations at a Middle East manufacturing organization stopped functioning normally. There were no encrypted files, no malicious processes running, no suspicious binaries on disk. Kaspersky's GERT team, called in the next day, discovered the entire attack lived inside Active Directory itself: a single Group Policy Object, created with domain admin privileges, had turned the internal infrastructure into an extortion weapon.

The Timeline of an Invisible Assault: From VPN Access to Ransom Wallpaper

Initial access occurred on April 11, 2026, when the attacker authenticated via a FortiGate SSL VPN portal using compromised domain credentials. The exact path from this first foothold to domain-admin-equivalent control remains partially opaque: the GERT report does not reconstruct the intermediate lateral movement and privilege escalation steps. What is documented precisely are the two decisive actions on April 13: the creation of the "PAYLOAD" GPO, with GUID {C897F2C7-C2AC-4E6F-BF48-58036FF29E79}, and its link to the domain root, followed shortly by a second object named "win Firewall Off" that disabled Windows Firewall on all profiles.

The "detonation" triggered on April 14, when workstation reboots applied the new policies. The result: wallpapers replaced with ransom images, lock screens modified, logon banners enforced via the legalnoticecaption and legalnoticetext registry keys, ransom notes dropped as README-payload.txt files, and the local administrator account disabled on every machine. The psychological and operational effect was indistinguishable from conventional ransomware, but the technical substance was radically different.

RSOP Reveals the Anatomy of an Attack Without a Payload

Forensic analysis by the GERT team used Resultant Set of Policy (RSOP) to reconstruct the distribution mechanism point by point. The PAYLOAD GPO leveraged five legitimate Group Policy Client-Side Extensions, each with a specific role in the extortion playbook.

The Files CSE handled ransom file distribution: hello.txt transformed into README-payload.txt. The Registry CSE enforced logon banners. The Personalization Policy CSE and Desktop Policy CSE (User branch) injected the payload.jpg image as wallpaper and lock screen. Finally, the Security Settings CSE, through the GptTmpl.inf file, disabled the local administrator account on all endpoints. None of these operations require malicious code: they are documented, supported, signed Windows features, executed automatically by a system service with SYSTEM privileges.

The PAYLOAD sample existed, but only in a different ecosystem: a Linux-targeting ESXi ransomware found on non-Windows systems. On every domain workstation, no resident malware, no endpoint persistence, no anomalous process was detected. The entire attack lived inside SYSVOL and Active Directory directories.

Why Traditional EDR Went Blind Against This Vector

The tactical significance of the PAYLOAD operation lies precisely in the structural invisibility it confers on the Group Policy channel. According to the GERT report, "Group Policy is a signed, allowlisted, SYSTEM-privileged distribution channel that the majority of endpoint detection and response tools is designed not to inspect." This characteristic is not an implementation bug: it is the result of a security architecture built to assume that traffic from domain controller to endpoint is inherently trustworthy.

The paradox is complete. EDR platforms are optimized to detect suspicious processes, anomalous executable disk writes, encryption patterns. When impact is delivered through an already-authorized, signed, OS-integrated mechanism, the file- and process-based detection stack becomes literally blind. As Kaspersky analysts note: "an organization whose detection strategy depends on catching a ransomware executable would have seen nothing until the first endpoint rebooted and the ransom wallpaper appeared." And further: "By delivering impact through GPO rather than through malware, the actor sidestepped the entire file- and process-based detection stack."

The Trend That Makes PAYLOAD a Signal, Not an Anomaly

The absence of encryption on Windows systems is not an isolated case, but the tip of an accelerating phenomenon. According to Symantec, the industry recorded 6,182 extortion attacks in 2025, a 23% increase over 2024, including encryptionless incidents. An aggregated figure from Kaspersky's annual report indicates that 28% of ransoms were paid in 2025, a factor driving operators to seek pressure methods cheaper and less detectable than mass encryption.

The use of Group Policy as an attack vector has documented precedents. Microsoft itself described in 2020 how Ryuk used GPO to propagate ransomware. Kaspersky reported Group Policy abuse by LockBit 2.0. However, in all these historical cases the GPO served to distribute an encryptor: the binary payload remained the lightning, Group Policy merely the lightning rod. PAYLOAD inverts this logic: the GPO is no longer the vehicle, but the weapon itself. Impact is pure, without executable intermediation.

"The entire attack lived inside Active Directory itself" — Kaspersky GERT, PAYLOAD incident response report

What to Do Now

The defensive response requires a fundamental realignment: treat Group Policy changes as first-class security events, not routine administration.

• Enable and centralize monitoring of Windows Event 5136, which tracks every modification to Group Policy Objects in Active Directory, with immediate alerting on creation or linking of GPOs at the domain root level
• Implement granular auditing of domain administration privileges, with periodic verification of who can create, modify, or link GPOs, and removal of permissions not strictly necessary
• Review trust policies: the SYSVOL/Group Policy channel must not be considered inherently safe, but subjected to inspection and validation like any other software distribution vector
• Design detection assuming Active Directory compromise can be used as a direct impact weapon, not just a launch platform for traditional malware

The Thin Line Between Administration and Aggression

PAYLOAD raises a deeper architectural question than a single campaign. Active Directory was designed as a centralized control tool: whoever holds the keys holds the network. This concentration of power, managed for decades as an availability and management problem, is emerging as an offensive security problem. When everyday administrative tools can be repurposed in minutes to paralyze an entire organization, the traditional perimeter between legitimate insider and external attacker dissolves.

GERT analysts do not identify the threat actor behind PAYLOAD, nor the precise path of the compromised FortiGate credentials. The report does not specify whether credentials were obtained via password spraying, credential stuffing, or purchase from an initial access broker. These gaps do not weaken the signal: the method is replicable, the attack surface is vast, and current defenses are inadequate. The next PAYLOAD may not bear that name, but the mechanism — a domain admin turning policy into a ransom message — is already encoded in every existing Windows installation.

Frequently Asked Questions

Why wasn't this attack detected by antivirus?

There was nothing to detect. The attack used exclusively legitimate Windows components — Group Policy Client-Side Extensions — executing with SYSTEM privileges through a signed, allowlisted channel. Traditional EDR tools are designed not to inspect this traffic.

Did the PAYLOAD GPO contain hidden malware?

No. According to the GERT report, the GPO contained no malicious binary payload. Impact was generated entirely through configuration of existing policies: file distribution, registry modification, desktop personalization, security settings.

Can this approach be used for damage more severe than wallpaper replacement?

The GERT report does not document impacts beyond those described in the specific incident. However, the mechanism — complete control of endpoint configurations via GPO — has intrinsic potential that goes beyond visual extortion. The dossier does not explore hypothetical future scenarios.

Sources

• https://securelist.com/tr/payload-ransomware-via-group-policy/121335/
• https://www.security.com/threat-intelligence/ransomware-extortion-epidemic
• https://securelist.com/state-of-ransomware-in-2026/119761/
• https://securelist.com/group-policies-in-cyberattacks/115331/
• https://www.microsoft.com/en-us/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
• https://www.kaspersky.com/blog/ransomware-group-policies/40877/