In April 2026 a manufacturing company in the Middle East woke up to ransom notes on every desktop, a ransom demand on every login screen and a locked administrator account. Kaspersky's Global Emergency Response Team, called in the following day, found no ransomware on any of those Windows machines: no encrypted files, no running malicious process, no startup entry, no scheduled task.
Group Policy is the mechanism a Windows domain uses to push configuration to every joined machine. It is signed, trusted, runs with SYSTEM privileges, and most endpoint security tools are built not to inspect it. The attacker created a single Group Policy Object, named it PAYLOAD, and linked it at the root of the domain, which applies it to every computer and user underneath.
One object, every workstation
What that object did reads like a configuration change, because that is what it was. It dropped a file staged on the domain controller's SYSVOL share onto each desktop and onto the C and D drive roots as a read-only README-payload.txt. It rewrote the registry values behind the pre-login legal notice, setting the caption to "Welcome to Payload!" and the body to the ransom demand. It set an image held in SYSVOL as both wallpaper and lock screen, processed in loopback mode so it applied to whoever signed in. And it disabled the built-in administrator account through the policy's security settings.
A second object linked at the same level, named "win Firewall Off", turned off Windows Firewall on all three profiles across every endpoint. Those two objects were the whole offensive toolkit on Windows. The only ransomware binary recovered in the case was a PAYLOAD sample aimed at ESXi servers on Linux. Data was separately exfiltrated from file servers and several other systems, and later published on the dark web.
A day of silence, then everything at once
The most instructive detail is the gap. The attacker authenticated to the company's FortiGate SSL VPN with a valid but compromised domain credential on 11 April and wrote both policy objects on 13 April. Nothing visible happened that day. Computer configuration settings apply on reboot or policy refresh, and no endpoint had restarted, so the policy sat cached on the machines and then detonated together on 14 April as staff rebooted normally.
That delay cuts both ways. It hands the attacker a quiet window for exfiltration and staging, which is what happened here, and it severs the link between a directory change logged on one day and mass disruption on another. Kaspersky could not reconstruct how the credential was stolen, because VPN appliance logging was insufficient; password spraying, phishing and an initial access broker purchase all remained plausible.
Watch the directory, not the disk
With no file to find, detection has to move to Active Directory itself. Kaspersky's responders, Ahmad Zaidi Said and Elsayed Elrefaei, recommend enabling Advanced Audit Policy for Directory Service Changes on all domain controllers and alerting on directory object creation (event 5137), modification (5136) and deletion (5141). A change to the gPLink attribute on the domain root by an account that is not an authorised policy administrator is, in their words, one of the most telling indicators of this attack class. They also advise file integrity monitoring on the SYSVOL policies share, and treating a SYSVOL content change with no matching 5136 event as suspicious, since that suggests the policy was edited directly with a tool such as PowerView or SharpGPOAbuse.
The full analysis is in the team's report. The event log clearing, security service termination and shadow copy deletion it also describes are family-level capabilities drawn from public analysis of PAYLOAD samples, and were not observed on this victim's endpoints.
Extortion without encryption is not new, and the crew behind PAYLOAD is one of a growing number leaning on it, alongside a rising count of named leak site victims. Kaspersky places the case within a shift toward extortion-only incidents that it says industry telemetry shows growing significantly year on year. What makes it worth studying is where the leverage came from. An organisation whose detection depended on catching a ransomware executable would have seen nothing at all until the first machine rebooted.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.