PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain Without Encryption

A PAYLOAD ransomware attack used Active Directory Group Policy Objects to disrupt an entire Windows domain without encrypting files or deploying ransomware binaries. The operation targeted a manufacturing organization in the Middle East. It relied on domain-level control, stolen credentials, and malicious GPOs to display ransom demands, disable defenses, and lock down administrator access. In April 2026, the attackers reportedly accessed the organization through its FortiGate SSL VPN using a valid but compromised domain account. The source of the credential theft remains unconfirmed. However, researchers considered phishing, password spraying, credential stuffing, or credentials purchased from an initial access broker as possible...

Read the full article at the source.