[CLSTR]
< Back to all clusters
[TECHNOLOGY] · Türkiye, United States · 8 sources

started · updated

Part of situation: PAYLOAD ransomware encryptionless extortion tactics (2 clusters)

PAYLOAD ransomware uses Group Policy to disrupt networks without encryption

PAYLOAD ransomware Active Directory Group Policy Object encryptionless extortion cybersecurity

Kaspersky’s Global Emergency Response Team (GERT) has identified a significant shift in ransomware tactics involving the PAYLOAD malware family. During an incident at a manufacturing company in the Middle East in April 2026, attackers bypassed traditional file encryption to cause operational disruption.

Instead of deploying standard encryptors, the threat actors gained domain administrator-equivalent privileges and weaponized Microsoft Active Directory Group Policy Objects (GPOs). They created a malicious GPO named ‘PAYLOAD’ linked at the domain root, which allowed them to control all domain-joined Windows workstations. The attack included changing desktop wallpapers and lock screens, displaying ransom notes, enforcing logon banners, and deactivating local administrator accounts.

A second GPO, named ‘win Firewall Off’, was used to disable Windows Firewall across the entire network. While the Windows endpoints remained unencrypted, the attackers exfiltrated sensitive data from file servers and subsequently published it on the dark web. The only traditional ransomware component identified was a PAYLOAD sample targeting ESXi on Linux servers. This ‘encryptionless extortion’ method focuses on immediate operational paralysis and data theft rather than cryptographic locking.

Entities

Active Directory · Fortinet · Kaspersky · Middle East · Payload

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Kaspersky identifica malware contra centrais de carros [itsection.com.br]
8 days ago
PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain [cybernoz.com]
8 days ago
MovieReaper usa torrents comprometidos e Solana para instalar malware modular [minutodaseguranca.blog.br]
7 days ago
PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks [cyberinsider.com]
7 days ago
Payload Fidye Yazılım Dosyaları Şifrelemeden Kurumsal 1 [donanimgunlugu.com]
6 days ago
برمجية فدية جديدة تستولي على أجهزة المؤسسات دون تشفير الملفات | لحظة نيوز [www.lahzanews.com]
7 days ago
Ransomware Without Encryption: PAYLOAD Weaponizes Windows Group Policy [www.technadu.com]
7 days ago
PAYLOAD ransomware attacks through Active Directory GPO [securelist.com]
8 days ago