An incident in April 2026 exposed a new strain of ransomware that bypassed traditional encryption altogether. Instead of encrypting files, the threat actor manipulated Active Directory Group Policy Objects (GPOs) to cripple a Windows domain. The attack leveraged a compromised account to seize domain-wide control, deploy malicious policies, and commandeer devices across a large enterprise environment.
How the Attack Unfolded
The intrusion began when attackers gained access to a manufacturing company in the Middle East by exploiting a valid but stolen domain user account through a FortiGate SSL VPN gateway. While the method used to obtain these credentials isn’t confirmed, potential vectors include phishing, password spraying, credential stuffing, or purchasing access from a broker.
Once inside, the attackers established two harmful Group Policy Objects, the first named “PAYLOAD,” which was applied at the root of the Active Directory domain. This gave it devastating reach, affecting nearly every connected machine. Unlike typical ransomware that encrypts files or drops executable binaries, PAYLOAD used native Windows policy features to deliver its impact: wallpaper and lock screen images were altered, login banners displaying “Welcome to Payload!” appeared, the local Administrator account was deactivated, and ransom notes were copied into the SYSVOL share. A second GPO dubbed “win Firewall Off” disabled the Windows Firewall across all profiles—domain, private, and public.
Security researchers noted that there were no signs of encryption, foreign binaries residing on endpoints, or traditional persistence methods like scheduled tasks or new services. Instead, the GPO link itself served as the main persistence mechanism. Changes put in motion on April 13 culminated in visible disruptions such as ransom messaging and lockout behaviors starting the following day. Researchers also discovered that sensitive data had been exfiltrated from file servers before the visible chaos, and that the attackers published stolen information on dark-web platforms, following what’s known as an encryption-less extortion model.
Why This Attack Stands Out
The PAYLOAD incident reveals an emerging threat where attackers use legitimate administrative tools like GPOs to bypass defenses that are heavily focused on detecting malware or suspicious binaries. Because GPOs are trusted by design and often whitelisted, the changes slipped past security products that monitor files and processes but overlook policy modifications deep within Active Directory.
Security professionals are urged to closely monitor specific Windows Event IDs—5137 (creation of GPO objects), 5136 (modification of directory objects), and 5141 (deletion events)—alongside changes to the gPLink attribute at the domain root and any unusual files surfacing in SYSVOL. Tightening the separation between who can create GPOs and who can link them, enforcing phishing-resistant multi-factor authentication for VPNs, and regularly rotating credentials are also essential countermeasures. Any malicious policies should be removed before sweeping endpoint remediation, and firewall and administrator settings must be restored using clean, trusted policies.
This case underscores a broader trend in ransomware: moving beyond file encryption toward operational disruption and data exfiltration. The shift presents new challenges for defenders, especially since it exploits the very management infrastructures organizations rely on. Defenders need to extend visibility into Active Directory operations—it’s no longer enough to just watch for suspicious binaries or encryption. The integrity of policy and administrative control has become ground zero in modern cybersecurity conflict.
