PAYLOAD Ransomware Hijacks Active Directory Group Policy for Encryptionless Extortion

A ransomware operation tracked as PAYLOAD has demonstrated how attackers can weaponize Microsoft Active Directory Group Policy Objects (GPOs) to disrupt an entire Windows domain without deploying endpoint ransomware or encrypting files. Kaspersky’s Global Emergency Response Team investigated the April 2026 incident at a Middle Eastern manufacturing organization, where attackers gained domain admin-equivalent privileges and created a malicious GPO named “PAYLOAD.” The policy…