Kaspersky experts identified a sophisticated cyberattack campaign dubbed Payload, targeting a manufacturing company in the Middle East. The attackers successfully gained control over the corporate network to demand a ransom without using file encryption or traditional malware.
The intruders accessed the network by exploiting compromised high-privilege user accounts via standard remote access tools and VPNs. These credentials were obtained through phishing, brute-force attacks, or purchased from initial access brokers. Their activity mimicked legitimate IT specialist logins, allowing them to evade detection systems.
The attackers manipulated the Active Directory infrastructure by creating a malicious Group Policy Object (GPO) named Payload. This allowed them to display ransom notes, alter desktop wallpapers, and disable administrator accounts. Because GPO rules are signed, they were treated as trusted system components.
After exfiltrating valuable corporate data and blocking administrative access, the attackers published the stolen information on the darknet to pressure the victim. Kaspersky recommends monitoring GPO changes, implementing phishing-resistant multi-factor authentication, and strictly limiting administrative privileges.
