PAYLOAD Ransomware Uses GPO Hijacking Technique

Executive Summary

A new ransomware group, tracked as PAYLOAD, has been observed employing a novel and highly disruptive technique that leverages Active Directory Group Policy for domain-wide impact without encrypting files. According to a report from Kaspersky's Global Emergency Response Team, an investigation in April 2026 at a manufacturing firm in the Middle East revealed this "encryptionless extortion" tactic. After gaining domain administrator-level privileges, the attackers created a malicious Group Policy Object (GPO) to deface every Windows workstation with a ransom note wallpaper. This attack was coupled with data exfiltration, creating a dual-threat scenario of business disruption and data leakage for extortion purposes.

Threat Overview

The incident represents a tactical evolution in ransomware attacks, moving away from the resource-intensive process of file encryption on individual endpoints. The PAYLOAD actors instead targeted a central management system—Active Directory—to achieve maximum visibility and psychological impact with minimal effort. After compromising the domain, the threat actors created a GPO named "PAYLOAD" and linked it to the root of the Active Directory domain. This ensured the policy was enforced across all user and computer objects. The GPO's primary function was to modify a registry key to change the desktop wallpaper on all domain-joined systems to an image containing their ransom demand. While this action did not deny access to data, it served as a powerful and visible demonstration of the attackers' control over the entire network. The extortion leverage was amplified by the confirmed exfiltration of data from file servers, which was later published on the dark web.

Technical Analysis

The core of this attack is the abuse of a legitimate administrative feature for malicious purposes. The technique is a direct implementation of MITRE ATT&CK T1484.001 - Group Policy Modification.

1. Initial Access & Privilege Escalation: The attackers first gained initial access (vector not specified) and escalated their privileges to the level of a Domain Administrator. This is a critical prerequisite, as modifying root-level GPOs requires the highest level of administrative rights within an Active Directory domain (T1078.002 - Domain Admin Accounts).
2. Malicious GPO Creation: The actors created a new GPO, reportedly named PAYLOAD. They configured this GPO to alter the HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper registry value on targeted machines, pointing it to a UNC path where the ransom note image was stored.
3. GPO Linking: The GPO was linked to the domain root. This is a crucial step that forces the policy to be inherited by all Organizational Units (OUs) and applied to all computers and users within the domain upon the next Group Policy refresh cycle.
4. Data Exfiltration: In parallel, the attackers used their privileged access to exfiltrate sensitive data from file servers (T1048 - Exfiltration Over Alternative Protocol). This completes the double-extortion model.

This "encryptionless" approach is efficient for attackers as it avoids potential detection from EDR/antivirus solutions that look for mass file encryption behavior. Instead, it masquerades as a legitimate administrative action.

Impact Assessment

While avoiding file encryption, the impact of this attack method is still severe:

• Operational Disruption: The widespread visual defacement can cause confusion and panic, leading employees to stop work. IT and security teams must dedicate significant resources to investigate the GPO changes, validate system integrity, and restore normal configurations across the entire domain.
• Data Breach: The exfiltration of data carries the same consequences as any other data breach, including regulatory fines, reputational damage, and the loss of intellectual property or sensitive customer information.
• Psychological Impact: This highly visible attack demonstrates complete control over the victim's network, creating immense pressure to pay the ransom to prevent further disruption or the public release of stolen data.
• Loss of Confidence: The compromise of Active Directory, the backbone of the enterprise network, signifies a fundamental security failure and erodes trust in the organization's security posture.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect GPO hijacking:

Detection & Response

Detecting malicious GPO modification requires focused monitoring of Active Directory.

1. Active Directory Auditing: Enable advanced audit policies for DS Access on Domain Controllers. Specifically, audit the Write permission for groupPolicyContainer objects. Use a SIEM to alert on GPO modifications that occur outside of planned change management windows or are performed by accounts not associated with GPO administration. This is a form of D3-DAM: Domain Account Monitoring.
2. SYSVOL Monitoring: Implement File Integrity Monitoring (FIM) on the SYSVOL share on all Domain Controllers. Alert on the creation of new GPO folders or modifications to key policy files like Registry.pol.
3. Honeypot GPOs: Create