Kaspersky's Global Emergency Response Team (GERT) reported on Securelist on 21 September 2026 on an April 2026 incident at a manufacturing organisation in the Middle East, where the attacker gained domain admin-equivalent control of Active Directory and linked a malicious Group Policy Object (GPO) named PAYLOAD at the domain root. Through that one object the attacker delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data.

The only ransomware Kaspersky found in the incident was a PAYLOAD sample targeting ESXi on Linux servers. Kaspersky says data was also stolen and later published. Initial access was a valid but compromised domain account used to log in through the organisation's FortiGate SSL VPN; Kaspersky could not reconstruct how the credential was stolen and considered password spraying or credential stuffing, phishing, and purchase from an initial access broker.

The PAYLOAD GPO dropped a SYSVOL hello.txt onto desktops and the C:\ and D:\ roots as a read-only README-payload.txt, set the logon banner text to the ransom note, set payload.jpg from SYSVOL as the lock screen and wallpaper, and disabled the administrator account through the Security Settings extension. A second domain-root GPO, “win Firewall Off”, disabled Windows Firewall on the domain, private and public profiles.

The policies were written and cached on endpoints on 13 April but only took effect when machines rebooted on 14 April. Kaspersky confirmed that no files were encrypted on Windows machines and none carried a .payload extension, that no endpoint persistence was established and that no malicious processes were running at the time of analysis; the persistence was the GPO link on the domain controller. Defensive focus: directory service change auditing (gPLink changes at the domain root), SYSVOL file integrity (unexpected images, text files, registry.pol/GptTmpl.inf) and the Group Policy Operational log on endpoints.

Kaspersky says public analysis of PAYLOAD Windows samples shows event log clearing, security process and service termination, and shadow copy deletion; these were not confirmed as having run in this GPO-based incident. No CVE. (source: Securelist)

Correction (30 Oct 2026): removed Cyber Security News as a source; the card now carries only what Securelist's report states. (source: Securelist)