Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.

Summary from Kaspersky Securelist.

Explained

The technology and terms in this story. Learn more

More in Endpoint

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

BleepingComputeryesterdayThreat IntelEndpointVulnerabilities

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

VideoCrowdStrike2d agoEndpointVulnerabilitiesCVE-2026-109618CVE-2026-109619

BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

The Hacker News2d agoThreat IntelEndpointVulnerabilities

Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

The Hacker News2d agoThreat IntelEndpointAI

Microsoft: Windows Server 2016 reaches end of support in January

BleepingComputer2d agoEndpoint