A recent incident involving a sophisticated PAYLOAD ransomware attack has brought to light the vulnerabilities associated with Microsoft Active Directory Group Policy. In a strikingly unconventional approach, the attackers managed to disrupt an organization’s Windows computers without resorting to traditional ransomware tactics such as file encryption.
Incident Overview
The attackers leveraged the organization’s own administrative infrastructure to inflict chaos. Instead of encrypting files, they displayed ransom notes, altered desktop wallpapers, disabled local administrator accounts, and turned off the Windows Firewall across the network. This incident was investigated by Kaspersky’s Global Emergency Response Team (GERT) following an attack on an unnamed manufacturing organization in the Middle East.
Kaspersky researchers Ahmad Zaidi Said and Elsayed Elrefaei reported that the breach began on April 11, when the attackers accessed the network through a compromised domain account via the company’s FortiGate SSL VPN. By April 13, they had escalated their privileges to that of a domain administrator and created a malicious Group Policy Object (GPO) dubbed “PAYLOAD.”
Exploitation of Group Policy
Group Policy is a legitimate Windows feature that allows centralized configuration of numerous computers and user accounts through Active Directory. The malicious GPO was strategically linked at the root of the company’s domain, enabling its settings to affect nearly every domain-joined Windows workstation. The attackers utilized this access to:
- Distribute a ransom note titled README-payload.txt
- Replace desktop and lock-screen images with a file named payload.jpg
- Display a ransom message during user login
- Disable the built-in local administrator account
A second GPO, named “win Firewall Off,” was deployed to disable Windows Firewall across all profiles—domain, private, and public. However, the malicious changes did not manifest immediately. Kaspersky discovered that while the policies reached endpoints on April 13, they remained dormant until systems were rebooted the following day. As employees restarted their computers on April 14, the malicious policies activated, leading to widespread disruption.
Data Exfiltration and Findings
In addition to the chaos caused by the GPOs, the attackers exfiltrated data from file servers and other systems, subsequently publishing the stolen information on the dark web. Kaspersky also identified a variant of the PAYLOAD ransomware that targeted ESXi servers, but found no evidence of Windows file encryption.
Forensic analysis revealed no malicious Windows executables, persistence mechanisms, or active malware processes. This attack effectively resided within Active Directory, allowing it to evade security monitoring systems that primarily focus on suspicious files and processes.
Recommendations for Organizations
This incident underscores the significant risks associated with unauthorized control of Group Policy, a tactic previously exploited by other ransomware operations, including Ryuk, LockBit, and BlackCat. Kaspersky advises organizations to:
- Closely monitor the creation and modification of GPOs, especially those linked at the domain level.
- Regularly check SYSVOL for unexpected files or configuration changes.
- Implement phishing-resistant multi-factor authentication (MFA) for VPN access.
- Restrict the ability to create and link Group Policies.
- Centrally collect Active Directory audit logs.
- Protect privileged administrator accounts.
In the event of a similar attack, organizations should prioritize the removal of malicious Group Policies from domain controllers before cleaning individual computers. Failing to do so may result in the reapplication of compromised policies during the next Group Policy refresh.
If you liked this article, be sure to follow us on X/Twitter and also LinkedIn for more exclusive content.
