Reported by 6 outlets

Timeline

1. original reporting

   Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO Indicators extracted from public reporting. Source: https:// secur

   securelist.ru · 22d ago · September 21st, 2026

   Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO Indicators extracted from public reporting. Source: https:// secur

   via Mastodon https://securelist.ru/tr/payload-ransomware-via-group-policy/117100/

2. update from malware.news

   Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

   malware.news · 22d ago · September 21st, 2026

   Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root. Through that single object, the actor delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data. The only ransomware we found in this incident was PAYLOAD sample targeting ESXi on Linux servers. Besides that, data exfiltration was observed originating from the file servers and several additional systems, and was later published on the dark web. This case is an example of two converging trends that define the 2026 ransomware landscape : Living-off-the-land abuse of trusted AD infrastructure. Group Policy is a signed, allowlisted, SYSTEM-privileged distribution channel that the majority of endpoint detection and response tools is designed

3. update from gbhackers.com

   PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain

   gbhackers.com · 22d ago · September 21st, 2026

   A ransomware incident in which attackers used Active Directory Group Policy to disrupt operations without deploying a Windows encryptor or leaving malware running on endpoints. In April 2026, the attackers accessed a FortiGate SSL VPN using compromised domain credentials, then gained domain-admin-equivalent rights. PAYLOAD Ransomware On April 13, Kaspersky’s Global Emergency Response Team (GERT) created […] The post PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   PAYLOAD Ransomware Hijacks Active Directory Group Policy for Encryptionless Extortion

   cyberpress.org · 22d ago · September 21st, 2026

   A ransomware operation tracked as PAYLOAD has demonstrated how attackers can weaponize Microsoft Active Directory Group Policy Objects (GPOs) to disrupt an entire Windows domain without deploying endpoint ransomware or encrypting files. Rather than executing an encryptor, the attackers abused trusted Windows management mechanisms . PAYLOAD Ransomware Hijacks Active Directory Group Policy The PAYLOAD GPO copied ransom notes to desktops and local drive roots, replaced desktop wallpaper and lock-screen images with a ransom message, configured a logon banner, and disabled the built-in local Administrator account. A second malicious GPO, named “win Firewall Off,” disabled Windows Firewall across domain, private, and public profiles. Settings changed by PAYLOAD GPO (Source: securelist) The operation illustrates a growing shift toward encryptionless extortion, in which attackers combine data theft, operational disruption, and threats of public exposure rather than relying solely on cryptographic file locking. Investigators observed data exfiltration from file servers and other systems, and later saw the stolen material publish

5. update from cyber.netsecops.io

   📰 PAYLOAD Ransomware Abuses GPOs for Encryptionless Extortion New PAYLOAD ransomware uses a novel technique, hijacking Active Directory GPOs

   cyber.netsecops.io · 22d ago · September 21st, 2026

   📰 PAYLOAD Ransomware Abuses GPOs for Encryptionless Extortion New PAYLOAD ransomware uses a novel technique, hijacking Active Directory GPOs

   via Mastodon https://cyber.netsecops.io/articles/payload-ransomware-hijacks-active-directory-gpo-for-encryptionless-extortion/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

6. mentioned by securelist.com

   New. Kaspersky: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO https:// securelist.com/tr/payload-rans omware-via

   securelist.com · 22d ago · September 21st, 2026

7. mentioned by securelist.com

   PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain Without Encryption Indicators extracted from public reporti

   securelist.com · 22d ago · September 21st, 2026

8. update from securelist.com

   https:// securelist.com/tr/payload-rans omware-via-group-policy/121335/ # Ransomware # ActiveDirectory # CyberSecurity # GroupPolicy # Paylo

   securelist.com · 22d ago · September 22nd, 2026

   https:// securelist.com/tr/payload-rans omware-via-group-policy/121335/ # Ransomware # ActiveDirectory # CyberSecurity # GroupPolicy # Paylo

   via Mastodon https://securelist.com/tr/payload-ransomware-via-group-policy/121335/