Executive Summary
Kaspersky reports an incident in which operators of the PAYLOAD ransomware family used Active Directory Group Policy to disrupt Windows workstations without encrypting Windows data. The actor signed in to a FortiGate SSL VPN on 11 April 2026 with a valid domain credential. The report does not establish how the credential was compromised. Logging was too limited to reconstruct the path to Group Policy write rights.
On 13 April the actor created a Group Policy Object named PAYLOAD and linked it at the domain root. A second object named win Firewall Off, also linked at the domain root, disabled Windows Firewall for the domain, private and public profiles. The PAYLOAD object copied a ransom note to each machine and set the logon banner, lock screen and wallpaper. It also disabled the local Administrator account. The policies applied to machines after reboots on 14 April.
The only encryptor found was a PAYLOAD sample for ESXi on Linux servers. The report gives no details about it. Data was taken from file servers and other systems on 13 April and later published on the dark web, but the report does not state the method. Kaspersky recommends auditing Directory Service events 5137, 5136 and 5141 and watching the SYSVOL policies folder.