Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
14 IOCs
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Threat Actors
Malware Families
Excerpt
Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root. Through that single object, the actor delivered ransom notes, hijacked the desktop…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(4)
Victim
Indicators of Compromise
Open the mindmap →14 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 104.164.55.46 | High | Score 58/100 | First seen |
| IP | 192.42.116.52 | High | Score 58/100 | First seen |
| IP | 149.102.229.154 | High | Score 58/100 | First seen |
| IP | 37.19.210.12 | High | Score 58/100 | First seen |
| IP | 104.28.163.162 | High | Score 58/100 | First seen |
| IP | 192.42.116.50 | High | Score 58/100 | First seen |
| IP | 192.42.116.97 | High | Score 58/100 | First seen |
| IP | 64.190.76.14 | High | Score 58/100 | First seen |
| IP | 192.42.116.12 | High | Score 58/100 | First seen |
| MD5 | 0108656a3e1ade6ca4f21b084f5e1208 | High | Score 86/100 | First seen |
| IP | 104.28.162.228 | High | Score 58/100 | First seen |
| IP | 192.42.116.56 | High | Score 58/100 | First seen |
| MD5 | bea5e267f24d7da59f6821bffdbff293 | High | Score 56/100 | First seen |
| IP | 146.70.117.239 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…