Middle Eastern manufacturing organization: PAYLOAD ransomware attacks through Active Directory GPO

Ransomware Without Encryption: How Attackers Weaponized Group Policy in a 2026 Middle East Breach

In April 2026, Kaspersky’s Global Emergency Response Team (GERT) investigated a cyberattack on a Middle Eastern manufacturing organization where threat actors achieved domain-wide disruption without deploying traditional ransomware. Instead, they exploited Active Directory Group Policy Objects (GPOs) to hijack systems, exfiltrate data, and demand payment, showcasing a growing trend in "encryptionless extortion."

The Attack: A Silent Takeover via Trusted Infrastructure

The threat actor gained domain admin-equivalent control of the victim’s Active Directory (AD) environment, then created a malicious GPO named PAYLOAD, linked at the domain root. This single policy:

• Deployed ransom notes (as README-payload.txt) to desktops and root directories.
• Hijacked lock screens and wallpapers with a ransom message (payload.jpg).
• Disabled local administrator accounts and enforced a logon banner.
• Disabled Windows Firewall via a second GPO (win Firewall Off).

Notably, no ransomware binary was executed on Windows machines the attack lived entirely within AD. The only encryption observed targeted ESXi Linux servers, while data exfiltrated from file servers was later published on the dark web.

Key Tactics: Living Off the Land and Delayed Detonation

1. Initial Access

   • The attacker used a compromised domain credential to authenticate via the organization’s FortiGate SSL VPN (no evidence of how the credential was stolen due to insufficient logging).
   • The account had GPO creation/linking privileges, suggesting domain admin or delegated rights.

2. GPO Abuse

   • Group Policy, a trusted, SYSTEM-privileged distribution channel, allowed the attacker to bypass endpoint detection (EDR tools typically ignore GPOs).
   • The PAYLOAD GPO modified registry keys, dropped files via SYSVOL, and disabled accounts all through legitimate AD mechanisms.

3. Delayed Impact

   • The GPO was created on April 13, but its effects only triggered after endpoints rebooted on April 14, creating a 24-hour window for undetected exfiltration.
   • This delay severed the link between the attack’s cause (GPO creation) and effect (mass disruption), complicating forensic analysis.

Forensic Findings: No Malware, No Persistence Just AD

Kaspersky’s investigation revealed:

• No file encryption on Windows machines (no .payload extensions or bulk renaming).
• No malicious binaries on disk or in memory.
• No endpoint persistence (clean scheduled tasks, Run keys, and services).
• No active malicious processes the attack’s persistence was the GPO link itself on the domain controller.

Why This Matters: The Shift to Encryptionless Extortion

This incident reflects two major 2026 ransomware trends:

1. Living-off-the-Land (LotL) Abuse

   • Attackers leverage built-in AD tools (GPOs, SYSVOL) to evade detection, as these channels are rarely scrutinized by EDR.
   • Similar tactics have been used by Ryuk, LockBit, and BlackCat to deploy ransomware or scheduled tasks.

2. Encryptionless Extortion

   • Instead of encrypting data, attackers disrupt operations (e.g., disabling accounts, defacing systems) and threaten escalation (e.g., publishing stolen data).
   • This model reduces the risk of irreversible damage while maintaining leverage over victims.

Detection Challenges and Defensive Gaps

• Traditional EDR blind spots: File- and process-based detection fails against GPO abuse.
• Delayed detonation: The gap between GPO creation and impact complicates incident response.
• Insufficient logging: FortiGate VPN and ESXi logs lacked details to reconstruct lateral movement.

Indicators of Compromise (IOCs)

• Malicious GPOs:
  • PAYLOAD ({C897F2C7-C2AC-4E6F-BF48-58036FF29E79})
  • win Firewall Off ({22099AD2-E062-4F56-B574-5099BBA4E7A6})
• Files:
  • payload.jpg (ransom image, SYSVOL)
  • hello.txt → README-payload.txt (ransom note)
• Registry Keys:
  • HKLM\...\Policies\System\legalnoticecaption = "Welcome to Payload!"
• Event IDs:
  • 5137 (GPO creation) – Review creator account.
  • 5136 (GPO modification) – Watch gPLink changes at the domain root.

MITRE ATT&CK Mapping

Conclusion: A Warning for AD-Centric Defenses

This attack demonstrates how threat actors can weaponize trusted infrastructure to achieve ransomware-like disruption without malware. Organizations relying solely on file/process-based detection are vulnerable effective defense requires:

• Directory service auditing (Event IDs 5136/5137).
• SYSVOL integrity monitoring (unexpected file changes).
• Privileged access governance (limiting GPO creation/linking rights).

The absence of encryption does not mean the compromise was minor the attacker gained domain admin control, proving that AD abuse can be just as devastating as traditional ransomware.

Source: https://securelist.com/tr/payload-ransomware-via-group-policy/121335/

Middle East Institute cybersecurity rating report: https://www.rankiteo.com/company/middle-east-institute

"id": "MID1789986392",
"linkid": "middle-east-institute",
"type": "Ransomware",
"date": "4/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Manufacturing',
                        'location': 'Middle East',
                        'type': 'Manufacturing organization'}],
 'attack_vector': 'Compromised domain credential via FortiGate SSL VPN',
 'data_breach': {'data_encryption': 'Only on ESXi Linux servers',
                 'data_exfiltration': 'Yes',
                 'personally_identifiable_information': 'Implied (not '
                                                        'explicitly stated)',
                 'sensitivity_of_data': 'High (data exfiltrated and published '
                                        'on the dark web)',
                 'type_of_data_compromised': 'File server data, personally '
                                             'identifiable information '
                                             '(implied)'},
 'date_detected': '2026-04-14',
 'description': 'In April 2026, Kaspersky’s Global Emergency Response Team '
                '(GERT) investigated a cyberattack on a Middle Eastern '
                'manufacturing organization where threat actors achieved '
                'domain-wide disruption without deploying traditional '
                'ransomware. Instead, they exploited Active Directory Group '
                'Policy Objects (GPOs) to hijack systems, exfiltrate data, and '
                "demand payment, showcasing a growing trend in 'encryptionless "
                "extortion.'",
 'impact': {'data_compromised': 'Exfiltrated data from file servers published '
                                'on the dark web',
            'operational_impact': 'Domain-wide disruption, disabled local '
                                  'administrator accounts, enforced logon '
                                  'banners, disabled Windows Firewall',
            'systems_affected': 'Windows endpoints, ESXi Linux servers, Active '
                                'Directory domain'},
 'initial_access_broker': {'data_sold_on_dark_web': 'Yes (exfiltrated data '
                                                    'published)',
                           'entry_point': 'Compromised domain credential via '
                                          'FortiGate SSL VPN',
                           'high_value_targets': 'Active Directory domain '
                                                 'controllers, file servers'},
 'investigation_status': 'Completed (forensic analysis by Kaspersky GERT)',
 'lessons_learned': 'Threat actors can weaponize trusted infrastructure (e.g., '
                    'AD GPOs) to achieve ransomware-like disruption without '
                    'malware. Traditional EDR tools may miss GPO abuse due to '
                    'delayed detonation and lack of file/process-based '
                    'indicators. Effective defense requires directory service '
                    'auditing, SYSVOL integrity monitoring, and privileged '
                    'access governance.',
 'motivation': 'Financial gain (ransom demand)',
 'post_incident_analysis': {'corrective_actions': ['Enhanced AD auditing and '
                                                   'SYSVOL monitoring',
                                                   'Privileged access '
                                                   'governance for GPO '
                                                   'management',
                                                   'Improved logging for '
                                                   'lateral movement '
                                                   'reconstruction'],
                            'root_causes': ['Compromised domain credential '
                                            'with GPO creation/linking '
                                            'privileges',
                                            'Insufficient logging for VPN and '
                                            'ESXi systems',
                                            'Delayed detonation of malicious '
                                            'GPOs evading detection']},
 'ransomware': {'data_encryption': 'Only on ESXi Linux servers',
                'data_exfiltration': 'Yes',
                'ransom_demanded': 'Yes (amount not specified)'},
 'recommendations': ['Implement directory service auditing (Event IDs '
                     '5136/5137).',
                     'Monitor SYSVOL for unexpected file changes.',
                     'Limit GPO creation/linking rights to privileged '
                     'accounts.',
                     'Enhance logging for VPN and ESXi systems to reconstruct '
                     'lateral movement.',
                     'Adopt a zero-trust model for Active Directory access.'],
 'references': [{'source': 'Kaspersky’s Global Emergency Response Team '
                           '(GERT)'}],
 'response': {'enhanced_monitoring': 'Directory service auditing (Event IDs '
                                     '5136/5137), SYSVOL integrity monitoring',
              'third_party_assistance': 'Kaspersky’s Global Emergency Response '
                                        'Team (GERT)'},
 'title': 'Ransomware Without Encryption: How Attackers Weaponized Group '
          'Policy in a 2026 Middle East Breach',
 'type': 'Ransomware (Encryptionless Extortion)',
 'vulnerability_exploited': 'Active Directory Group Policy Objects (GPOs) '
                            'abuse'}