Kaspersky SecurelistMedium
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPOExecutive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East. The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group…