Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

A security incident occurred in April 2026 where an actor gained domain admin-equivalent control of a manufacturing organization’s Active Directory. The threat actor leveraged malicious Group Policy Objects (GPOs), specifically named PAYLOAD and win Firewall Off, to achieve impact without deploying ransomware binaries directly on endpoints. The PAYLOAD GPO configured malicious settings for wallpaper, lock screen, logon banners, and disabled the local administrator account by manipulating group policy extensions in SYSVOL. A second GPO disabled the Windows Firewall across the domain. The attack involved a one-day dormancy period before visible changes appeared upon endpoint reboots. Data exfiltration was observed from file servers prior to impact.
The incident highlights two primary trends in the 2026 ransomware landscape: the living-off-the-land abuse of trusted Active Directory infrastructure, specifically GPO, for delivery, and encryptionless extortion where operational disruption is the primary leverage. The forensic investigation found no files were encrypted on Windows machines, and no malicious binaries or persistence mechanisms were found on endpoints, indicating the impact was achieved entirely through policy manipulation within the domain structure.

* An actor obtained domain admin-equivalent control of an Active Directory environment in April 2026.
* A malicious GPO named PAYLOAD was created and linked at the domain root.
* PAYLOAD configured ransom notes, wallpaper, lock screen, logon banners, and disabled the local administrator account via GPO settings.
* A second GPO, win Firewall Off, was created to disable Windows Firewall across all profiles.
* Data exfiltration was observed from file servers prior to impact.
* The payload utilized Group Policy Preferences extensions to modify registry settings (e.g., legalnoticecaption) and file paths within SYSVOL.
* No ransomware binaries were found on endpoints, and no malicious processes or persistence mechanisms existed on workstations at the time of analysis.
* The attack demonstrated a one-day dormancy period between GPO creation and visible impact upon endpoint rebooting.
* Detection engineering focused on directory service change auditing (DS Access) and SYSVOL file integrity monitoring.

The mechanism demonstrated here shifts the locus of compromise from endpoint artifacts to the core trust infrastructure, revealing a systemic failure in perimeter defense that relies too heavily on inspecting process behavior or file presence. The ability to weaponize Group Policy as a delivery channel bypasses conventional endpoint detection and response (EDR) stacks designed for catching malware execution. This illustrates a significant evolution where persistence is established not via malicious executables but via the legitimate, trusted mechanisms of system configuration itself.
The observation that encryption was absent points toward an extortion model focused on operational paralysis rather than cryptographic denial of access, suggesting actors are prioritizing maximum disruption and potential secondary negotiation leverage over immediate data destruction. This necessitates a re-evaluation of detection priorities away from file system monitoring towards centralized control plane integrity. The pattern of leveraging established, signed infrastructure—like GPO—to deliver impact is an echo of past ransomware methods but elevated in sophistication by abstracting the payload into configuration logic.
The resilience against this attack hinges on visibility into Active Directory state changes. If detection relies solely on endpoint-centric artifacts, it will remain blind to attacks executed entirely within the domain's control plane. The defensive implication is that monitoring the integrity of SYSVOL and auditing specific GPO attribute changes must become a foundational layer for network defense. What systems are tracking changes to system configuration policies outside the standard management consoles? How do we build automated controls around these privileged settings, rather than waiting for anomalous file writes on local disks?