Date: 09/22/2026
Severity: Critical
Summary
In April 2026, a threat actor compromised a Middle Eastern manufacturing organization and gained domain administrator-level control of its Active Directory environment. The attacker created a malicious Group Policy Object (GPO) named PAYLOAD and linked it to the domain root to affect all domain-joined Windows systems. The GPO delivered ransom notes, changed desktop and lock-screen wallpapers, displayed a logon banner, and disabled local administrator accounts without encrypting data or deploying Windows ransomware. The only ransomware identified was a PAYLOAD sample targeting ESXi on Linux servers, while data was also exfiltrated from file servers and other systems. The stolen data was subsequently published on the dark web, demonstrating an attack focused on disruption and data theft rather than traditional ransomware encryption.
Indicators of Compromise (IOC) List
IP Address | 37.19.210.12 146.70.117.239 149.102.229.154 104.164.55.46 104.28.162.228 104.28.163.162 64.190.76.14 192.42.116.50 192.42.116.12 192.42.116.56 192.42.116.97 192.42.116.52 |
Hash | 0108656A3E1ADE6CA4F21B084F5E1208
BEA5E267F24D7DA59F6821BFFDBFF293
|
Registry Key | HKLM\...\Policies\System\legalnoticecaption = Welcome to Payload! |
Filepath | \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\payload.jpg |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("104.28.163.162","149.102.229.154","192.42.116.97","37.19.210.12","104.28.162.228","192.42.116.50","146.70.117.239","104.164.55.46","192.42.116.12","192.42.116.52","64.190.76.14","192.42.116.56") or srcipaddress IN ("104.28.163.162","149.102.229.154","192.42.116.97","37.19.210.12","104.28.162.228","192.42.116.50","146.70.117.239","104.164.55.46","192.42.116.12","192.42.116.52","64.190.76.14","192.42.116.56") |
Detection Query 2 : | md5hash IN ("0108656A3E1ADE6CA4F21B084F5E1208","BEA5E267F24D7DA59F6821BFFDBFF293")
|
Detection Query 3 : | datasourcename = "Windows Security" and eventtype = "4657" and objectname like "HKLM\%\Policies\System\legalnoticecaption = Welcome to Payload!" |
Detection Query 4 : | technologygroup = "EDR" and objectname like "HKLM\%\Policies\System\legalnoticecaption = Welcome to Payload!" |
Detection Query 5 : | datasourcename = "Windows Security" and eventtype = "4663" and objecttype like "\\DC.THECOMPANY.local\sysvol\THECOMPANY.local\payload.jpg" |
Detection Query 6 : | technologygroup = "EDR" and objecttype like "\\DC.THECOMPANY.local\sysvol\THECOMPANY.local\payload.jpg" |
Reference:
https://securelist.com/tr/payload-ransomware-via-group-policy/121335/