Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Strategic summary

In April 2026, Kaspersky's Global Emergency Response Team investigated a security incident at a manufacturing organization in the Middle East. The attackers gained domain admin-equivalent control over Active Directory and created a malicious Group Policy Object named PAYLOAD, linked at the domain root. Through this GPO, they delivered ransom notes, hijacked desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account on all domain-joined Windows workstations. No ransomware was deployed or data encrypted on Windows; only a PAYLOAD sample targeting ESXi on Linux servers was found, and data exfiltration occurred with later publication on the dark web.

Key findings

• Attackers obtained domain admin-equivalent control over Active Directory and created a malicious Group Policy Object named PAYLOAD, linked at the domain root.
• Through this GPO, they delivered ransom notes, hijacked desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account on all domain-joined Windows workstations.
• No ransomware binary was dropped and no data encrypted on Windows systems; only a PAYLOAD sample targeting ESXi on Linux servers was discovered.
• Data exfiltration from file servers and additional systems was observed and later published on the dark web.
• The abuse of trusted AD infrastructure (living-off-the-land) leverages Group Policy as a signed, allowlisted, SYSTEM-privileged distribution channel that is often not inspected by EDR tools.