PAYLOAD
Unknown Dormant
- Mentions
- 1
- First seen
- 21 Sept 2026
- Last seen
- 21 Sept 2026
Relevant to you · Affects your stack
- Technology:
- Microsoft Active Directory
- Threat focus:
- ransomware
Origin
Unattributed
Profile
PAYLOAD is a ransomware actor that hijacks Active Directory Group Policy Objects (GPOs) to weaponize them for ransomware deployment. The reporting indicates the actor leverages GPO hijacking to propagate or execute ransomware in compromised environments. No further details on targeted sectors or regions are provided in the headline.
Affected vendors
Microsoft
Associated malware / tools
PAYLOAD ransomware