Kaspersky Uncovers Stealthy Payload Ransomware Campaign Targeting Corporate Networks

ISLAMABAD: Kaspersky’s Global Emergency Response Team (GERT) has uncovered a sophisticated attack involving the Payload ransomware family. The campaign targeted a manufacturing company in the Middle East.

According to Kaspersky, the attackers gained extensive control of the company’s network. They forced computers to lock, displayed ransom notes and changed desktop wallpapers.

However, they did not deploy a conventional file-encrypting ransomware program.

The incident highlights a growing cybercrime trend known as “encryptionless extortion”. In these attacks, criminals focus on disrupting operations and stealing sensitive data rather than encrypting files.

Attackers Exploit Stolen Administrator Credentials

Kaspersky said the attackers likely obtained highly privileged credentials through phishing.

They then used the credentials to access the company network through legitimate remote-access and VPN services.

This approach helped the attackers avoid detection. Their activity appeared similar to routine logins by authorised IT personnel.

The attackers also avoided relying heavily on conventional malware. Instead, they used trusted administrative tools already present within the corporate environment.

Malicious Group Policy Enabled the Attack

The attackers targeted Active Directory, a central component of many corporate networks.

They created a malicious Group Policy Object (GPO). The attackers named the policy “PAYLOAD”.

Group Policy allows administrators to apply settings across large numbers of computers. As a result, a malicious GPO can affect thousands of devices quickly.

Because the attackers used compromised administrative accounts, the changes could resemble legitimate IT activity.

The malicious policy disabled local administrator accounts. It also distributed ransom notes and changed desktop wallpapers and lock screens.

These changes appeared once affected computers processed the updated policies.

Data Theft Became Central to the Extortion

The attackers also focused on stealing valuable corporate information.

After completing the data theft, they triggered administrative lockouts across the network. The stolen information was later published on the dark web as part of the extortion attempt.

The incident demonstrates how ransomware operations are changing.

Traditional ransomware typically relies on file encryption to pressure victims into paying. In contrast, encryptionless attacks can combine network disruption with data theft and public disclosure.

Ishaq Dar Urges OIC to Step Up Diplomatic Efforts Over Palestine

Kaspersky Warns of GPO-Based Threats

Elsayed Elrefaei, a security expert with Kaspersky’s Global Emergency Response Team, said the PAYLOAD campaign represents another development in cybercrime tactics.

He warned that conventional endpoint malware scanning may not detect attacks while malicious Group Policy rules remain active.

Kaspersky recommends that organisations closely monitor the creation and modification of GPOs.

Security alerts should also be configured to flag new policies linked to the root of a corporate network.

The company further recommends stronger protection for administrative systems and VPN access.

Stronger Controls Needed for Privileged Accounts

Kaspersky advises organisations to use phishing-resistant multi-factor authentication for administrative access.

Physical security keys are one example of such protection.

The company also recommends strict separation of administrative privileges.

General IT administrators should not have unrestricted access to every workstation and server.

Highly privileged Domain Admin accounts should instead be limited to dedicated and isolated systems.

The recommendations reflect a broader shift in cybersecurity defence. Organisations increasingly need to monitor unusual behaviour and administrative activity, rather than relying only on traditional malware detection.