A malicious Group Policy Object named PAYLOAD delivered domain-wide ransomware impact on Windows with no encryption binary and no endpoint persistence, while a separate binary hit ESXi and Linux servers

Kaspersky's Global Emergency Response Team (GERT) reconstructs an April 2026 incident at a Middle East manufacturing organization in which an attacker authenticated to a FortiGate SSL VPN using a compromised credential of unconfirmed provenance, obtained Group-Policy-write privileges via an unconfirmed escalation path, and authored a malicious Group Policy Object named "PAYLOAD" linked at the domain root (Kaspersky Securelist, 2026-09-21). On every Windows workstation, the GPO used only native client-side extensions (CSEs) to achieve the operation's whole visible impact, with no encryptor of any kind: the Files CSE dropped a read-only ransom note to the desktop and the C: and D: drive roots; the Registry CSE rewrote the Windows logon legal-notice banner to ransom text; the Personalization/Desktop policy set a SYSVOL-hosted ransom image as every machine's lock screen and wallpaper; and Security Settings CSE (GptTmpl.inf) disabled the local Administrator account fleet-wide, alongside a second GPO disabling Windows Firewall domain-wide.

Because computer-configuration GPO settings apply only on reboot or a policy refresh cycle, the malicious policy sat cached and dormant for a full day between authoring (13 April) and mass visible impact (14 April); during that window, data exfiltration from file servers and several additional systems proceeded unnoticed. On the Windows domain-joined estate specifically, Kaspersky's forensic reconstruction found no files encrypted, no ransomware binary resident on disk, and no endpoint persistence mechanism of any kind: a detection program keyed on ransomware executables, encryption behavior, or process-level anomalies would have produced zero alerts until the ransom wallpaper appeared, post-reboot, on every affected desktop simultaneously. Kaspersky is explicit that this no-binary finding is scoped to that Windows activity: "The only ransomware we found in this incident was PAYLOAD sample targeting ESXi on Linux servers" (Kaspersky Securelist, 2026-09-21): a genuine ransomware binary was deployed, but against the organization's ESXi/Linux servers, a separate track from the GPO-only attack on Windows. The exfiltrated data was later published on the dark web, per Kaspersky's own account, confirming the extortion followed through beyond the operational-disruption phase. Kaspersky does not treat the absence of Windows-side encryption as settled: it assesses "with moderate confidence that the missing encryption reflects one of two scenarios: (1) a deliberate decision to stay below the irreversible data destruction threshold while preserving the option of a follow-on encryption phase, or (2) an operation interrupted before full execution" (Kaspersky Securelist, 2026-09-21).

Kaspersky refers to PAYLOAD operators but does not name them or the site where the data was published (Kaspersky Securelist, 2026-09-21). Ransomware.live profiles a ransomware group also called Payload that runs a leak site and, it says, uses Babuk-derived code against Windows and ESXi systems (Ransomware.live). No cited source establishes that this group is behind the incident Kaspersky describes.

Triage: for the Windows-side GPO attack, the discriminator is Group Policy content and change history, not endpoint behavior, since no encryption or binary execution occurs on those hosts. Kaspersky calls a gPLink change at the domain root by a non-standard account one of the most telling indicators of this attack class (Kaspersky Securelist, 2026-09-21). In this incident one new domain-root GPO combined ransom-note file drops, a ransom logon banner, a ransom wallpaper and lock screen and disablement of the local Administrator account, and a second domain-root GPO disabled Windows Firewall (Kaspersky Securelist, 2026-09-21). That combination, not an Administrator-account or firewall setting on its own, separates the attack from routine policy work. On ESXi/Linux hosts, the discriminator is the ordinary one for ransomware: an actual PAYLOAD binary execution.