PAYLOAD ransomware attacks through Active Directory GPO

In April 2026, a manufacturing organization in the Middle East was targeted by a ransomware attack leveraging Active Directory Group Policy Objects (GPOs) without deploying ransomware binaries on endpoints. Attackers with domain admin privileges created malicious GPOs linked at the domain root to distribute ransom notes, modify user interface elements, enforce logon banners, and disable local administrator accounts across all domain-joined workstations. The attack did not encrypt files but focused on operational disruption and data exfiltration. Initial access was obtained via compromised VPN credentials. The attackers delayed activation by one day to evade detection by file-based security tools, exploiting trusted Active Directory infrastructure for domain-wide impact.

• Hackers Impersonate IT Help Desk on Microsoft Teams to Hijack Active Directory Accounts and Steal DataMalware2026-10-31
• BOSSAI: Inside the AI attack mesh that targeted Taiwan's emergency servicesCampaign2026-11-04
• n0n Ransomware: Inside an AI-Assisted Extortion OperationMalware2026-10-28
• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of LockoutsCampaign2026-10-07