Ransomware Attack Exploits Active Directory to Evade Detection
In a complex and alarming ransomware incident, malicious actors successfully leveraged an Active Directory Group Policy (GPO) to conduct their operations without resorting to traditional methods of file encryption or leaving malware on endpoint devices. This innovative approach represents a significant evolution in the tactics employed by cybercriminals, illustrating their ability to exploit existing administrative tools to disrupt organizational operations.
Timeline of the Attack
The incident commenced in April 2026, when attackers gained unauthorized entry into a FortiGate SSL VPN using compromised domain credentials. This breach enabled the attackers to acquire domain-admin-equivalent rights, providing them substantial control over the network environment.
On April 13, Kaspersky’s Global Emergency Response Team (GERT) registered the creation of a malicious GPO titled “PAYLOAD,” directly linked to the root of the Active Directory domain. This strategic configuration allowed the GPO to propagate its influence across all domain-connected systems, facilitating widespread disruption.
Mechanism of the Attack
Unlike conventional ransomware attacks that encrypt user files, the PAYLOAD GPO employed standard Windows administrative functions to inflict psychological and operational harm. It enacted several disruptive measures: it copied ransom notes from the SYSVOL directory, set a ransom-themed image as the desktop wallpaper and lock screen, configured a "Welcome to Payload!" logon banner, and deactivated the local Administrator account.
The attackers implemented an additional GPO named “win Firewall Off,” which disabled the Windows Firewall settings across various profiles—domain, private, and public. This comprehensive approach constituted a tactical masterpiece, allowing the attackers to exploit legitimate Windows functionalities to achieve their malicious goals while avoiding detection by conventional security measures. Because the attack transpired through standard GPO processing mechanisms, the attack’s logic remained embedded in the malicious configurations, distinguishing it from typical executable-based malware.
During Kaspersky’s investigation, they reported a lack of encrypted files, malicious binaries, persistent threats, injected code, or covert processes on the endpoints, highlighting the insidious nature of this attack.
Operational Details and Impact
The attackers discreetly staged files named “payload.jpg” and “hello.txt” within the domain controller’s SYSVOL share. The malicious GPO diligently copied the ransom note text to users’ desktops and designated root directories as a read-only file named “README-payload.txt.” Concurrently, it modified Windows registry values to alter legal notice messages and utilized “GptTmpl.inf” settings to disable the Administrator account.
A delay of one day separated the weaponization of the GPO and its disruptive impact. Policy artifacts were cached on April 13, but the actual disruption began the following day when endpoints rebooted and absorbed the new configurations. During this window, investigators recognized a pattern of data exfiltration from file servers, with sensitive data later surfacing on dark web platforms.
This incident underscores the potential for GPO links to serve dual purposes: functioning as both a tool for disruption and a means of maintaining persistence within the compromised environment. A simple removal of local artifacts would not suffice to resolve the situation; the domain controller was set to reapply the malign settings during the next refresh or reboot, thereby perpetuating the threat.
Response Recommendations
In response to such sophisticated attacks, investigators and IT security teams must adopt a multifaceted approach. Immediate actions should include the removal of malicious GPOs and any files housed in SYSVOL, restoration of firewall settings and local administrator controls using a clean policy, and a thorough rotation of any compromised credentials. If the attack confirms Domain Admin compromise, the krbtgt account should be reset twice to mitigate further risks.
Key detection efforts should focus on scrutinizing Active Directory configurations and SYSVOL directories. Security teams are advised to enable Directory Service Change auditing and pay particular attention to Event IDs 5137, 5136, and 5141. These IDs relate to the creation of GPO objects, attribute modifications, and deletions, respectively, particularly with nonstandard accounts.
Moreover, organizations should implement file integrity monitoring measures to issue alerts for any modifications to images, text files, scripts, registry.pol, and GptTmpl.inf under SYSVOL. Analyzing logs from Endpoint Group Policy Operational logs, Group Policy History, and Shadow registry locations can further validate policy applications post-attack.
This incident also reinforces a concerning trend in cyber extortion, shifting towards encryptionless methods. While a PAYLOAD sample was discovered targeting ESXi within Linux infrastructures, the primary impact on Windows systems stemmed from an exploitation of the victim’s own identity and administrative mechanisms.
To fortify defenses against such evolving tactics, organizations should enforce phishing-resistant multi-factor authentication (MFA) for VPN access, separate GPO creation from linking permissions, and monitor all changes at the domain-root level meticulously.
In light of this incident, it is clearer than ever that the cyber threat landscape is continuously evolving, demanding vigilance and preparedness from organizations to effectively counteract sophisticated cyber threats.