An advanced ransomware attack has leveraged Active Directory Group Policy Objects (GPO) to disrupt a Windows domain without utilizing file encryption, affecting a manufacturing firm in the Middle East.
This incident, occurring in April 2026, showcased how attackers can manipulate domain-level controls, utilize stolen credentials, and deploy malicious GPOs to issue ransom demands, disable security defenses, and restrict administrator access.
Attack Methodology and Access
The perpetrators reportedly infiltrated the organization using a compromised domain account via the FortiGate SSL VPN. The exact method of credential compromise remains uncertain, although phishing, password spraying, credential stuffing, or acquisition from an initial access broker are suspected.
Once sufficient privileges were attained, the attackers engineered a malicious GPO, named PAYLOAD, and linked it to the root of the Active Directory domain, thereby impacting nearly all domain-connected devices.
Technical Execution and Impact
Instead of deploying traditional ransomware executables, the PAYLOAD GPO utilized Windows policy mechanisms to propagate ransom notes, modify desktop backgrounds and lock screens, display ransom messages, and deactivate local Administrator accounts.
A secondary GPO, named “win Firewall Off,” was also created to disable Windows Firewall across various profiles, enhancing the attack’s effectiveness by weakening network defenses.
The attack was particularly insidious as it operated largely within the Active Directory framework. Kaspersky’s analysis revealed no encrypted files or malicious binaries on affected systems, with the attack relying on policy changes and pre-existing system tools.
Data Exfiltration and Organizational Response
Before the visible disruption, data was exfiltrated from file servers, which was later published on a dark-web leak site, indicating a strategy of encryptionless extortion through data theft and operational disruption.
This incident underscores the necessity for organizations to broaden their cybersecurity focus beyond conventional ransomware defenses. Monitoring Active Directory changes, especially specific Event IDs, and alerting on unauthorized GPO alterations are critical measures.
Organizations are advised to promptly eradicate malicious GPOs, update compromised credentials, and restore secure policy settings. Implementing phishing-resistant multi-factor authentication for VPN access is also recommended to enhance security posture.
By maintaining SYSVOL integrity and separating GPO creation and linking rights, enterprises can mitigate the risk of widespread policy manipulation.
