Researchers at Kaspersky have documented an attack by the PAYLOAD ransomware that paralyzes an entire Windows domain without encrypting a single file. Instead of using encryption, the operators leverage native Windows policy mechanisms to enforce disruption across the environment.
The core of the attack is a malicious Group Policy Object named PAYLOAD linked directly to the root of the Active Directory domain. A policy applied at this level reaches virtually every connected device, turning it into a corporate-wide disruption tool.
Through the GPO, the group distributes ransom notes from SYSVOL, replaces wallpapers and lock screens with extortion images displaying the message Welcome to Payload, and disables local administrator accounts on affected machines. A second policy object named win Firewall Off disables the Windows firewall across the entire fleet, increasing exposure during the operation.
The extortion model combines data theft with operational shutdown. For the victim, the practical effect is similar to traditional ransomware, but without any decryption key to negotiate.
Initial access occurred in April 2026 via a compromised legitimate domain account on a FortiGate SSL VPN. Phishing, password spraying, and credential stuffing are among the possible paths for obtaining this credential. The victim is a manufacturing company in the Middle East.
Recommendations include monitoring the creation and modification of GPOs, alerting on changes to the gPLink attribute at the domain root, removing malicious objects before cleaning endpoints, rotating compromised credentials, enforcing phishing-resistant MFA on VPN access, tracking SYSVOL integrity, and separating rights to create and link policies.
