Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Kaspersky GERT investigated a PAYLOAD extortion incident where an attacker, using a compromised VPN credential, obtained domain-admin-equivalent rights and weaponized Active Directory Group Policy to deliver ransom wallpaper, lock-screen imagery, logon banners, dropped ransom notes, disabled local Administrator accounts and turned off host firewalls across domain-joined machines without deploying a ransomware binary on Windows endpoints; data exfiltration from file servers was observed and PAYLOAD samples targeting ESXi were also identified on Linux servers. The report reconstructs the timeline, forensic evidence (no Windows file encryption or endpoint-resident malware), provides IOCs and MITRE mappings, and gives prioritized remediation and detection guidance focusing on AD/GPO auditing, SYSVOL monitoring, credential hardening, and SIEM/EDR rule recommendations.