Threats Tagged 'sysvol abuse'

In April 2026, a manufacturing organization in the Middle East was targeted by a ransomware attack leveraging Active Directory Group Policy Objects (GPOs) without deploying ransomware binaries on endpoints. Attackers with domain admin privileges created malicious GPOs linked at the domain root to deliver ransom notes, hijack wallpapers and lock screens, enforce logon banners, and disable local administrator accounts across all domain-joined workstations. The attack did not involve file encryption but focused on operational disruption and data exfiltration. Initial access was gained through compromised VPN credentials. The attack remained dormant for one day after GPO creation to evade detection by abusing trusted Active Directory infrastructure.