In April 2026, a manufacturing organization in the Middle East was targeted by a ransomware attack leveraging Active Directory Group Policy Objects (GPOs) without deploying ransomware binaries on endpoints. Attackers with domain admin privileges created malicious GPOs linked at the domain root to distribute ransom notes, modify user interface elements, enforce logon banners, and disable local administrator accounts across all domain-joined workstations. The attack did not encrypt files but focused on operational disruption and data exfiltration. Initial access was obtained via compromised VPN credentials. The attackers delayed activation by one day to evade detection by file-based security tools, exploiting trusted Active Directory infrastructure for domain-wide impact.