DUBAI, September 24 — A manufacturing company in the Middle East lost control of its entire Windows estate to a single malicious Group Policy Object, and the attackers never needed to plant a ransomware file to do it. Kaspersky’s Global Emergency Response Team (GERT) responded to the incident in April 2026 after a threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment.
From there, the actor authored a malicious GPO named PAYLOAD and linked it at the domain root — the top of the directory tree, where a link applies to every computer and user object beneath it. That one object did the work of an entire intrusion toolkit.
Through PAYLOAD, the attacker delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across every domain-joined Windows workstation.
No binary, no encryption, no trace on disk
Kaspersky confirmed what its investigators did not find. No files were encrypted on Windows machines. No malicious binaries were resident on disk.
No endpoint persistence had been established, and no malicious processes were running at the time of analysis. The entire attack lived inside Active Directory itself.
The only ransomware discovered in the incident was a PAYLOAD sample targeting ESXi on Linux servers. Data exfiltration was observed originating from file servers and several additional systems, and that data was later published on the dark web. The defensive implication is blunt.
An organization whose detection strategy depends on catching a ransomware executable would have seen nothing until the first endpoint rebooted and the ransom wallpaper appeared.
Why a GPO is such a powerful thing to steal
A Group Policy Object is essentially a combination of a Group Policy Container in Active Directory and a Group Policy Template in SYSVOL. Its scope depends on where the container is linked — at the domain, site, or organizational unit level. A link at the domain root means the policy applies to every computer and user object beneath it, which is why a GPO compromised at that level can reach all in-scope domain users and computers and potentially hand an attacker complete control over the corporate network.
Group policies are processed in a trusted, high-privilege environment. That is also why persistence survives: cleaning up the endpoints is not enough to remove them.
This is not an isolated technique. Microsoft observed Ryuk operators distributing ransomware through Group Policy, SYSVOL startup items, and PsExec. LockBit affiliates have been documented modifying SYSVOL Group Policy files, including ScheduledTasks.xml, to support ransomware execution and propagation.
BlackCat/ALPHV operators have also abused GPOs to create scheduled tasks and deploy ransomware. PAYLOAD stands apart from those cases.
It weaponizes GPO Preferences and policy settings for pure impact rather than as a launcher for an encryptor. Kaspersky said it reconstructed the attack timeline during the April 2026 investigation and provided operational advice on how to detect such threats, including detailed remediation recommendations. For IT teams across the region, the lesson sits in a place many monitoring stacks barely watch — the directory itself.
The next thing to watch is whether defenders start treating unusual GPO creation and domain-root linking as a first-class alert, rather than waiting for a wallpaper to change.
