[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHQBxt5R01GjvEYiA9xAVT3SbNbnN14nktOPxOMCiQ8g":3},{"article":4,"iocs":54,"watch_terms":57,"solutions":58,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"1a1f87dc-412c-48b0-87ff-da4527f9cbbc","Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO","group-policy-hijacked-payload-ransomware-weaponizes-active-directory-gpo-59ac98","Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.","Kaspersky GERT analyzed a manufacturing organization incident where the PAYLOAD ransomware group leveraged Active Directory Group Policy Objects (GPOs) for an encryptionless attack. The threat actor gained domain admin control, created a malicious GPO to deliver ransom notes, alter desktop backgrounds, and disable local administrator accounts without deploying any binaries or encrypting data on Windows machines. The attack also involved data exfiltration and targeting ESXi servers.","PAYLOAD ransomware group uses Active Directory GPO for encryptionless attacks.","https:\u002F\u002Fsecurelist.com\u002Ftr\u002Fpayload-ransomware-via-group-policy\u002F121335\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F09\u002F11153056\u002Fpayload-ransomware-featured-image.jpg","2026-09-21T10:00:40+00:00","2026-09-21T12:00:37.599208+00:00",9,[17,20,23,26],{"name":18,"type":19},"PAYLOAD","threat_actor",{"name":21,"type":22},"Active Directory","product",{"name":24,"type":25},"Group Policy Objects","technology",{"name":27,"type":22},"ESXi","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44,49],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":30,"name":52,"slug":53},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[55],{"type":48,"value":18,"context":56},"Ransomware family name used in the attack",[21,27],{"controls":59,"vendors":147},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":90,"name":91,"problem":92,"products":93},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":119,"name":120,"problem":121,"products":122},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[153],"affected",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":173},"ransomware-group-hijacks-active-directory-gpo-to-weaponize-domain-admin-access","Ransomware Group Hijacks Active Directory GPO to Weaponize Domain Admin Access","The PAYLOAD ransomware group exploited domain administrator-level privileges to manipulate Active Directory Group Policy Objects, enabling a widespread attack without deploying a single malicious binary or encrypting files. By abusing a legitimate Windows management mechanism, the threat actor delivered ransom notes, altered desktop backgrounds, and disabled local administrator accounts across the organization's Windows estate. This 'living-off-the-land' approach bypasses traditional endpoint detection tools that focus on malicious executables or encryption activity. The attack highlights the catastrophic blast radius when privileged AD credentials are compromised and GPO changes go unmonitored. It also demonstrates that ransomware extortion no longer requires encryption — data exfiltration and operational disruption alone can be sufficient leverage.",[159,160,161,162,163,164,165,166,167,168,169,170,171,172],"CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 5: Account Management","CIS Control 8: Audit Log Management","CIS Control 18: Penetration Testing","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 CM-3: Configuration Change Control","NIST SP 800-53 SI-4: System Monitoring","MITRE ATT&CK T1484.001: Domain Policy Modification – Group Policy","MITRE ATT&CK T1078.002: Valid Accounts – Domain Accounts","Microsoft Enterprise Access Model (Tiered Administration)","ITIL Change Management – Change Authorization for Infrastructure Modifications","GDPR Article 32: Security of Processing (for organizations subject to EU data protection law)",{}]