PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A recent incident involving a sophisticated PAYLOAD ransomware attack has shed light on the vulnerabilities within Microsoft Active Directory Group Policy. This attack, which unfolded at a manufacturing organization in the Middle East, did not follow the typical ransomware playbook of encrypting files. Instead, it leveraged the organization’s own administrative infrastructure to wreak havoc.

Details of the Attack

Kaspersky’s Global Emergency Response Team (GERT) took charge of the investigation, revealing that the attackers gained initial access to the network on April 11 by exploiting a compromised domain account via the company’s FortiGate SSL VPN. By April 13, they had escalated their privileges to those of a domain administrator and created a malicious Group Policy Object (GPO) dubbed “PAYLOAD.”

This GPO, a legitimate Windows feature designed for centralized configuration, was linked at the root of the company’s domain, allowing its settings to propagate to nearly every domain-joined Windows workstation. The attackers utilized this access to:

• Distribute a ransom note titled README-payload.txt
• Change desktop and lock-screen images to payload.jpg
• Display a ransom message during login
• Disable the built-in local administrator account

Additionally, a secondary GPO named “win Firewall Off” was employed to disable Windows Firewall across all profiles—domain, private, and public. However, the malicious changes did not manifest immediately. Kaspersky discovered that while the policies reached endpoints on April 13, they remained dormant until the computers were rebooted the following day. As employees powered up their systems on April 14, the policies activated, leading to widespread disruption across the organization.

The attackers also exfiltrated sensitive data from file servers, later releasing this information on the dark web. Although Kaspersky identified a variant of PAYLOAD targeting ESXi servers, there was no evidence of Windows files being encrypted. Forensic analysis revealed no malicious executables or active malware processes, indicating that the attack was effectively contained within Active Directory, allowing it to evade traditional security monitoring focused on suspicious files and processes.

Implications and Recommendations

This incident underscores the significant risks associated with unauthorized control over Group Policy, a tactic previously exploited by ransomware groups such as Ryuk, LockBit, and BlackCat. In light of these developments, Kaspersky advises organizations to:

1. Closely monitor the creation and modification of GPOs, especially those linked at the domain level.
2. Regularly check SYSVOL for unexpected files or configuration changes.
3. Implement phishing-resistant multi-factor authentication (MFA) for VPN access.
4. Restrict permissions for creating and linking Group Policies.
5. Centrally collect Active Directory audit logs.
6. Safeguard privileged administrator accounts.

In the event of a similar attack, organizations should prioritize the removal of malicious Group Policies from domain controllers before addressing individual computers, as compromised policies can be reinstated during the next Group Policy refresh.

If you liked this article, be sure to follow us on X/Twitter and also LinkedIn for more exclusive content.