Ransomware Operators Hijack Active Directory via GPO to Lock Companies Without Encryption

Kaspersky researchers have identified a new extortion campaign named Payload that allows attackers to disable entire corporate networks without using any encryption malware. The operation, discovered at a manufacturing enterprise, demonstrates how threat actors can achieve full disruption by abusing native Windows administration tools.

Attackers gained initial access through compromised privileged accounts. These credentials enabled them to connect via standard remote-access and VPN services that appeared as routine IT work. Once inside, the intruders took control of Active Directory and created a new Group Policy Object called Payload linked directly to the domain root.

After the GPO propagated, every workstation received new desktop wallpapers and lock-screen images containing ransom instructions. At the same time, all administrative accounts were disabled, preventing legitimate staff from regaining control. Because the changes were delivered through the trusted Group Policy mechanism, they bypassed most security controls and spread rapidly across the network.

Prior to the lockdown, the operators also stole valuable corporate data. The stolen information was later published on dark-web forums and used as additional leverage to demand payment. No files were encrypted during the incident, yet the victim faced the same operational and reputational damage typically associated with ransomware attacks.

Kaspersky analysts note that conventional antivirus scanning is insufficient against this technique. They advise organizations to monitor creation and modification of Group Policy Objects, enforce phishing-resistant multi-factor authentication on VPN and administrative systems, and strictly separate privileges to reduce the blast radius of any single compromised account.