PAYLOAD

PAYLOAD Ransomware Seizes Active Directory GPO to Disrupt Entire Windows Domain Without Encryption

Researchers at Kaspersky have documented an attack by the PAYLOAD ransomware that paralyzes an entire Windows domain without encrypting a single file. Instead of encryption, the operators leverage native Windows policy mechanisms to enforce disruption across the environment. The core of the attack is a malicious Group Policy Object named PAYLOAD linked directly to the root of the Active Directory domain. This placement allows the policy to reach virtually every connected device, turning it into a corporate-wide disruption tool. Through the GPO, the group distributes ransom notes from SYSVOL, replaces wallpapers and lock screens with extortion images displaying the message Welcome to Payload, and disables local administrator accounts on affected machines. A second policy object named win Firewall Off disables the Windows firewall across the entire fleet, increasing exposure during the operation. Initial access occurred in April 2026 via a compromised legitimate domain account on a FortiGate SSL VPN, with possible entry vectors including phishing, password spraying, and credential stuffing. The victim is a manufacturing company in the Middle East. The extortion model combines data theft with operational shutdown, delivering effects similar to traditional ransomware but without any decryption key to negotiate.

Ransomware Operators Hijack Active Directory via GPO to Lock Companies Without Encryption

Kaspersky researchers have uncovered a new extortion campaign called Payload that targets manufacturing companies by compromising privileged accounts and seizing control of Active Directory. Instead of deploying traditional ransomware encryptors, the attackers created a Group Policy Object named Payload linked to the domain root. This GPO automatically changed desktop wallpapers and lock screens across all systems, displayed ransom demands, and disabled administrative accounts after policy refresh. The group also exfiltrated valuable corporate data before the lockdown and later published it on the dark web to increase pressure on victims. Because the attack relied entirely on legitimate Windows mechanisms such as VPN access and Group Policy, conventional antivirus solutions proved ineffective. Experts recommend monitoring GPO changes, enforcing phishing-resistant MFA on VPN and admin systems, and applying least-privilege principles to limit the impact of credential compromise.

Kaspersky Details MovieReaper Malware Framework Distributed via Compromised Torrent Trackers

Kaspersky researchers have uncovered MovieReaper, a previously unknown modular malware framework that spreads through popular torrent sites by masquerading as movies, games, and other content. The campaign began after attackers compromised the itorrents repository in October 2025, allowing malicious torrents to propagate across multiple trackers and infect hundreds of users across Europe, Asia, and Africa. MovieReaper uses a multi-stage infection chain that includes a fake executable with a VLC icon, shellcode delivery from an initial C2, and a secondary C2 address retrieved from the Solana blockchain to improve resilience against takedowns. Subsequent stages bypass Windows UAC for persistence before deploying a final module with 21 commands for file system access, exfiltration, and potential additional payload deployment. The same report also covers NightEagle attacks on Russian infrastructure and the PAYLOAD extortion campaign using Active Directory Group Policy. Separate research highlights new side-channel attacks such as InjectEave on headphones and DDRop against Intel TDX and AMD SEV-SNP protections, along with a zero-day in Google Pixel radio modules and the arrest of TeamPCP members facilitated by Google Threat Intelligence Group.