PAYLOAD Ransomware: Active Directory GPO Hijacking

 

PAYLOAD Ransomware: Active Directory GPO Hijacking

On September 21, 2026, researchers published an investigation into an April 2026 incident involving a manufacturing organization in the Middle East. Rather than deploying a conventional Windows ransomware executable, the PAYLOAD operators gained domain-admin-equivalent control and weaponized legitimate Active Directory Group Policy Objects to create domain-wide disruption.

What makes PAYLOAD different

The Windows portion of the attack was essentially ransomware without the traditional ransomware binary.

Investigators reported:

• No encrypted Windows files.
• No ransomware executable residing on affected Windows endpoints.
• No malicious scheduled tasks, services, Run keys, or WMI persistence.
• No active malicious Windows process associated with the disruption.
• Persistence and distribution occurred through Active Directory and Group Policy itself.

That is significant because endpoint defenses tend to focus heavily on files, processes and malware execution. PAYLOAD instead turned a trusted SYSTEM-level enterprise administration mechanism into the attack delivery system.

---

Attack chain

Compromised Domain Credential
          |
          v
FortiGate SSL VPN
          |
          v
Domain-admin-equivalent privileges
          |
          v
Active Directory
          |
          +----> PAYLOAD GPO
          |        |
          |        +--> Ransom note
          |        +--> Desktop wallpaper
          |        +--> Lock-screen image
          |        +--> Logon banner
          |        +--> Disable local Administrator
          |
          +----> "win Firewall Off" GPO
                   |
                   +--> Disable Windows Firewall
          +
          +----> Data exfiltration

reconstructed initial access to April 11, 2026, when a valid but compromised domain account authenticated through the organization's SSL VPN. Investigators could not establish exactly how the credentials had originally been compromised.

By April 13, the attackers had sufficient Active Directory privileges to create a GPO called PAYLOAD and link it to the domain root, dramatically increasing its potential scope.

The attackers also created a second GPO named win Firewall Off, which disabled for domain, private and public profiles.

SYSVOL became part of the delivery mechanism

The attackers staged payload.jpg and hello.txt in SYSVOL. The malicious policy subsequently distributed the ransom content and configured affected systems with the attacker's wallpaper, lock screen and logon message.

One particularly interesting characteristic was delayed impact.

The malicious policy reached endpoints on April 13, but many of the computer-level changes did not visibly take effect until endpoints rebooted on April 14. That provided a period between the Active Directory compromise and the obvious organization-wide symptoms.

The biggest lesson isn't the PAYLOAD name.

It's this:

If an attacker controls your domain-level GPO infrastructure, your existing Windows management infrastructure can become their deployment platform.

A single malicious domain-linked policy potentially gives an attacker tremendous reach without having to individually compromise every workstation.

The incident also involved data exfiltration, with stolen information subsequently appearing on a dark-web leak site. Therefore this should not be interpreted simply as vandalism through wallpaper and policy changes. It represents an encryption less extortion model combining data theft and operational disruption.

did identify a PAYLOAD ransomware sample targeting ESXi/Linux servers in the investigation, but did not find evidence of Windows file encryption in this incident.

 I'd put GPO/DC monitoring ahead of looking for a PAYLOAD executable.

1. Domain-root GPO changes

Alert whenever someone:

• Creates a GPO.
• Deletes a GPO.
• Links a GPO to the domain root.
• Changes an existing domain-level GPO.
• Changes GPO security filtering.
• Modifies delegation.
• Changes Windows Firewall or Defender policies.
• Changes local Administrator settings.

A domain-root GPO creation or link should be treated as a high-severity administrative event, particularly outside a maintenance window.

2. SYSVOL

Monitor:

\\<domain>\SYSVOL\

for unexpected creation/modification of:

• .jpg
• .png
• .txt
• .bat
• .cmd
• .ps1
• .vbs
• .exe
• .dll
• Group Policy preference XML files

PAYLOAD specifically staged payload.jpg and hello.txt in SYSVOL.

3. VPN authentication

The investigated compromise started with a legitimate domain credential accessing the SSL VPN.

For a FortiGate environment, I'd correlate:

VPN authentication
       |
       v
Successful domain authentication
       |
       v
Privileged AD activity
       |
       v
GPO creation/modification
       |
       v
SYSVOL modification

That correlation would be considerably more useful for this attack than simply searching endpoints for ransomware hashes.

Protect privileged AD accounts

Administrators capable of modifying domain-wide Group Policy should not be ordinary VPN/user accounts.

I'd strongly recommend:

• Separate administrative identities.
• MFA for VPN and privileged access.
• No email/web access from Tier-0 administrative identities.
• Privileged Access Workstations for AD administration.
• Restrict Domain Admin membership.
• Audit delegated GPO creation/link permissions.
• Alert on privileged-group membership changes.

Sentinel detection opportunity

Since you've previously been working with <Microsoft Sentinel, PAYLOAD is an excellent candidate for a dedicated detection package.

I'd build detections around behavior rather than the threat-actor name, particularly:

GPO Created
        +
GPO Linked to Domain Root
        +
SYSVOL Content Changed
        +
Firewall Policy Changed
        +
Privileged Account Activity
        +
FortiGate VPN Authentication

This approach should detect not only PAYLOAD but also future actors attempting the same Active Directory abuse pattern.

The research specifically emphasizes monitoring directory service changes, Group Policy modifications and GPO-related activity because traditional endpoint-focused indicators may simply not exist in this type of attack.

Bottom line

PAYLOAD isn't particularly frightening because of sophisticated ransomware code. It's frightening because it demonstrates that an attacker who owns Active Directory may not need ransomware code on Windows endpoints at all.

For a Windows enterprise, Domain Controllers, privileged credentials, GPOs and SYSVOL should consequently be treated as ransomware-critical infrastructure, not merely administration infrastructure.

If you're defending an environment with FortiGate + Active Directory + Microsoft Sentinel, the particularly useful next step would be a Sentinel detection set for PAYLOAD-style GPO attacks, including domain-root GPO changes, SYSVOL modifications, firewall-disable policies, privileged account activity, and FortiGate VPN-to-AD correlation.