Ransomware group PAYLOAD weaponizes Microsoft Active Directory for disruption

A new ransomware tactic has emerged where attackers exploit Microsoft Active Directory Group Policy to disrupt an organization's Windows computers without deploying traditional ransomware or encrypting files, according to Kaspersky’s Global Emergency Response Team. Instead, threat actors leverage the victim's own administrative infrastructure to display ransom notes, alter system configurations, and disable security features, with further coverage provided by Cyber Insider.

The PAYLOAD ransomware group targeted a manufacturing organization in the Middle East, gaining initial access via a compromised VPN account, Kaspersky reported. After achieving domain administrator privileges, they created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO, linked at the domain's root, allowed them to distribute ransom notes, change wallpapers, deactivate local administrator accounts, and disable Windows Firewall across the network. A second GPO, "win Firewall Off," further compromised security. The changes were triggered upon system restarts, causing widespread disruption. The attackers also exfiltrated data and published it on the dark web. Notably, no malicious executables or active malware processes were found, indicating the attack operated entirely within Active Directory, bypassing traditional security monitoring.

This incident underscores the risk of compromised Group Policy, a method previously used by other ransomware groups like Ryuk and LockBit. Kaspersky recommends enhanced monitoring of GPO changes, securing SYSVOL, enforcing MFA for VPN access, restricting GPO creation privileges, and centralizing Active Directory audit logs to mitigate such threats.

Source: Cyber Insider