Researchers at Kaspersky have detailed a ransomware-style attack against a manufacturing organization in the Middle East that skipped the step most people associate with ransomware entirely: encrypting files. Instead, the group behind it, tracked as PAYLOAD, took over an entire Windows domain by rewriting Group Policy — the same trusted administrative mechanism IT teams use every day to push settings across a network.

Getting In Through the Front Door

The intrusion began, as many still do, with remote access software. Investigators traced initial entry to a FortiGate SSL VPN, accessed using a valid domain account. Kaspersky was unable to confirm exactly how that account was compromised, but pointed to the usual suspects: phishing, password spraying, credential stuffing, or a credential purchase from an initial access broker. Whatever the method, a legitimate login meant the attackers didn’t need to fight their way past endpoint defenses to get a foothold.

Turning Group Policy Into a Weapon

With domain credentials in hand, the attackers created two Group Policy Objects and linked one of them directly to the domain root — a placement that pushes its settings out to nearly every device joined to that domain. One GPO, simply named “PAYLOAD,” and a second dubbed “win Firewall Off,” did the damage:

• Ransom notes were pushed out as desktop wallpapers and lock-screen images across affected machines
• A logon banner reading “Welcome to Payload!” greeted anyone signing in
• Local Administrator accounts were deactivated domain-wide
• Windows Firewall was disabled across every profile, clearing the way for further access

According to Kaspersky’s timeline, the attackers staged a payload.jpg image and a hello.txt file inside the SYSVOL share on April 13, 2026. When endpoints rebooted the next day, the ransom messaging appeared network-wide almost simultaneously — a direct result of how quickly and broadly Group Policy propagates once applied at the domain root.

Quietly Effective Persistence

What makes the PAYLOAD approach notable to defenders is what it left behind: nothing. Kaspersky’s analysis found no encrypted files, no malicious binaries planted on the compromised machines, and no suspicious processes running at the time of disruption. The persistence mechanism was simply the malicious GPO link sitting on the domain controller, an object that looks, to most security tooling, exactly like a routine administrative change.

Two auxiliary tools were recovered from the environment, tracked as killer.exe and kill.exe, but the core disruption technique didn’t depend on deploying malware at all. As Kaspersky put it, GPOs are “trusted, allowlisted, and high-privilege administrative tools,” which means security products built to inspect files, scripts, and running processes have comparatively little to flag when the attack vector is a policy object instead.

Data Left the Building Before the Lights Went Out

The disruption wasn’t the only consequence. Investigators found evidence that files were exfiltrated from servers before the domain-wide takeover became visible to staff, and that stolen data later surfaced on a dark-web leak site — the now-familiar double-extortion pattern, minus the encryption step that usually accompanies it.

What Defenders Should Take From This

The PAYLOAD incident is a reminder that “no encrypted files” doesn’t mean “no ransomware attack,” and that Active Directory itself deserves the same monitoring rigor as endpoints. Security teams should treat new or modified GPOs — particularly ones linked at the domain root, created outside change-management windows, or touching firewall and account-lockout settings — as high-priority alerts. Regularly auditing domain-root GPO links, restricting who can create or modify policy objects, and logging Group Policy changes to a SIEM are all far cheaper than discovering, the way this manufacturer did, that an entire domain can be held hostage without a single file being touched.