A ransomware incident in which attackers used Active Directory Group Policy to disrupt operations without deploying a Windows encryptor or leaving malware running on endpoints.
In April 2026, the attackers accessed a FortiGate SSL VPN using compromised domain credentials, then gained domain-admin-equivalent rights.
PAYLOAD Ransomware
On April 13, Kaspersky’s Global Emergency Response Team (GERT) created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the Active Directory domain, allowing it to affect all domain-joined systems.
Instead of encrypting files on workstations, the policy employed Windows administrative functions to copy ransom notes from SYSVOL, set a ransom image as users’ wallpaper and lock screen, configure a “Welcome to Payload!” logon banner, and deactivate the local Administrator account.
Additionally, a second root-linked GPO named “win Firewall Off” disabled the Windows Firewall across domain, private, and public profiles.
This combination created a widespread impact on the enterprise while avoiding typical ransomware detection. GPO processing is a legitimate Windows management mechanism, so the attack logic lived in the malicious configuration rather than in executables.
During their examination, Kaspersky found no encrypted files on Windows endpoints, malicious binaries, persistence on endpoints, injected code, or malicious processes.
The attackers staged “payload.jpg” and “hello.txt” in the domain controller’s SYSVOL share. The PAYLOAD policy copied the text file to the desktop and root locations as a read-only file called “README-payload.txt,” and applied the image as the wallpaper and lock screen.
It modified the registry values for “legalnoticecaption” and “legalnoticetext,” and used “GptTmpl.inf” security settings to disable the Administrator account.
A one-day delay separated weaponization and disruption. Policy artifacts were written and cached on April 13. However, the actual impact began after endpoints rebooted on April 14 and the computer settings took effect.
This timing gave the attackers a window to stage, as investigators noticed exfiltration from file servers, with data later published on a dark web site.
This incident highlights how a GPO link can serve as both a disruption mechanism and a persistence point. Simply removing local artifacts would not resolve the compromise, as the domain controller would reapply the settings during the next refresh or restart.
Responders must remove malicious GPOs and SYSVOL-hosted files, restore firewall and local administrator settings with a clean policy, and rotate compromised and privileged credentials. If Domain Admin compromise is confirmed, organizations should reset the krbtgt account twice.
Detection efforts should focus on Active Directory and SYSVOL. Teams should enable Directory Service Change auditing and investigate Event IDs 5137, 5136, and 5141, particularly for nonstandard accounts creating or modifying groupPolicyContainer objects or modifying gPLink at the domain root.
File integrity monitoring should alert on any changes to images, text files, scripts, registry.pol, and GptTmpl.inf under SYSVOL. The logs in Endpoint Group Policy Operational logs, Group Policy History, and Shadow registry locations can help verify policy application after the attack.
This case reinforces the trend toward encryptionless extortion. Although a PAYLOAD sample targeting ESXi was found on Linux infrastructure, the impact on Windows systems relied on abusing the victim’s identity and management plane.
Defenders should enforce phishing-resistant multi-factor authentication (MFA) for VPN access, separate GPO creation from linking permissions, restrict Tier 0 administration, and monitor every domain-root policy change as a large-scale incident.
IOC Table
| IOC Type | Indicator | Description |
|---|---|---|
| Malicious GPO | PAYLOAD | GPO GUID: {C897F2C7-C2AC-4E6F-BF48-58036FF29E79} |
| Malicious GPO | win Firewall Off | GPO GUID: {22099AD2-E062-4F56-B574-5099BBA4E7A6} |
| SYSVOL file | payload.jpg | Ransom image used for desktop wallpaper and lock screen |
| SYSVOL file | hello.txt | Source ransom note copied through Group Policy Preferences |
| Dropped file | README-payload.txt | Read-only ransom note written to desktops and C: / D: roots |
| Tool | killer.exe | Process-killing utility; MD5: 0108656A3E1ADE6CA4F21B084F5E1208 |
| Tool | kill.exe | Process-killing utility; MD5: BEA5E267F24D7DA59F6821BFFDBFF293 |
| Registry value | HKLM...PoliciesSystemlegalnoticecaption | Set to Welcome to Payload! |
| SYSVOL path | \DC.THECOMPANY.localsysvolTHECOMPANY.localpayload.jpg | Domain-hosted ransom wallpaper source |
| Windows Event ID | 5137 | Creation of a GPO object; review creator identity |
| Windows Event ID | 5136 | GPO attribute modification; monitor domain-root gPLink changes |
| Windows Event ID | 5141 | GPO object deletion; relevant for tampering and remediation validation |
| IP address | 37.19.210[.]12 | Associated network indicator |
| IP address | 146.70.117[.]239 | Associated network indicator |
| IP address | 149.102.229[.]154 | Associated network indicator |
| IP address | 104.164.55[.]46 | Associated network indicator |
| IP address | 192.42.116[.]50 | Associated network indicator |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
