#ParsedReport #CompletenessHigh
21-09-2026

Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

https://securelist.com/tr/payload-ransomware-via-group-policy/121335/

Report completeness: High

Threats:
Payload_ransomware
Lolbin_technique
Ryuk
Lockbit
Blackcat
Password_spray_technique
Credential_harvesting_technique
Dcsync_technique
Kerberoasting_technique
Passthehash_technique
Process_hollowing_technique
Powerview_tool
Sharpgpoabuse_tool
Shadow_copies_delete_technique
Byovd_technique

Victims:
Manufacturing organization

Geo:
Middle east

TTPs:
Tactics: 7
Technics: 17

IOCs:
File: 9
Registry: 3
Hash: 2
IP: 12
Domain: 0
Url: 0
Email: 0
BrowserExtension: 0

Soft:
Active Directory, ESXi, Linux, PsExec, FortiGate, Windows Firewall, Windows Security, Event Tracing for Windows, Windows Defender

Algorithms:
md5

Win API:
THECOMPANY, EvtOpenChannelEnum, EvtNextChannelPath, EvtClearLog, EtwEventWrite, EtwEventWriteFull, EtwEventWriteTransfer

Languages:
powershell