PAYLOAD Ransomware Weaponizes Active Directory GPO

In April 2026, Kaspersky's Global Emergency Response Team (GERT) identified an incident where threat actors gained domain administrator-equivalent control to weaponize Active Directory Group Policy Objects (GPOs). The campaign, dubbed PAYLOAD, is notable for its 'encryptionless extortion' approach on Windows endpoints, using legitimate GPO mechanisms to deploy ransom wallpapers, lock local administrator accounts, and disable Windows Firewalls across the entire domain without dropping a malicious executable on the target workstations.

The attack utilized the victim's own infrastructure to ensure persistence and high-privilege execution, effectively bypassing traditional file-based EDR detection. While Windows endpoints were not encrypted, a PAYLOAD variant was found targeting ESXi Linux servers, and significant data exfiltration occurred. This reflects a growing trend in the 2026 ransomware landscape toward operational disruption and data extortion rather than purely cryptographic denial of service.

The incident highlights a critical gap in detection strategies that focus solely on process execution. Because the malicious logic resided entirely within the GPO configuration, the attack remained dormant and invisible until system reboots triggered the application of the malicious policies, resulting in immediate organization-wide disruption.