Image: Kaspersky researchers
A manufacturing company in the Middle East had its Active Directory Group Policy hijacked, pushing ransom messages and disruptive settings to every domain-joined Windows workstation. The April 2026 incident matters to organizations using Windows domains because ordinary endpoint malware scans would not have caught the policy changes.
Trusted policies became the delivery system
Kaspersky researchers said the attacker gained domain administrator-equivalent control and created a Group Policy Object named PAYLOAD. A Group Policy Object, or GPO, centrally controls settings for computers and users in a Windows domain.Linked at the domain root, PAYLOAD changed desktop wallpaper and lock screens, displayed ransom notes and a logon banner, and disabled the local Administrator account. A second GPO named “win Firewall Off” disabled Windows Firewall across domain, private and public profiles; this weakened that specific host defense rather than proving all protection was removed.
Reboots triggered the visible disruption
The attacker created the policies on April 13, but most affected PCs did not show the changes until they rebooted on April 14. Investigators found that the policies had already been cached locally, creating a quiet delay before the organization-wide impact appeared.The initial access came through the company’s FortiGate SSL VPN using a valid but compromised domain account. Limited appliance logging meant investigators could not determine how those credentials were stolen or reconstruct the full path to GPO control.
What administrators should check
Because the malicious instructions lived in Active Directory and SYSVOL rather than a Windows ransomware program, recovery must start with domain controllers. Cleaning individual workstations alone would leave the policy capable of applying again.- Review domain-root GPO links for PAYLOAD with GUID {C897F2C7-C2AC-4E6F-BF48-58036FF29E79} and “win Firewall Off” with GUID {22099AD2-E062-4F56-B574-5099BBA4E7A6}.
- Enable Directory Service Changes auditing on domain controllers and alert on Event ID 5137 for new GPO objects and Event ID 5136 for changed domain-root gPLink values.
- Inspect SYSVOL for unexpected payload.jpg and hello.txt files, and verify who can create or link GPOs at the domain root.
- Reset exposed privileged credentials and investigate FortiGate VPN access before allowing normal policy processing to resume.
