INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Group Policy Hijacked by Ransomware Using Active Directory GPO

| 2026-10-02 09:20 CRITICAL HIGH RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
Authorities have made significant strides in combating the KillSec ransomware group, which has been linked to hundreds of cyber-attacks worldwide. The operation resulted in eight house searches across Spain, Greece, Romania, and the UK, yielding evidence and assets seized alongside three provisional arrests, including a 16-year-old suspected administrator and main operator. A Dutch national living in the UK has also been indicted by US authorities on charges related to KillSec. Europol reports that the group exploited software vulnerabilities and cloud storage access points to target organizations such as hospitals, government bodies, and financial institutions. The operation, dubbed Operation KillSwitch, led to the seizure of at least 110TB of stolen data and prevented its exposure. German police were involved in the campaign, which also resulted in the arrest of Fouad Eltibrizi, aka Archduke, on hacking and extortion-related offenses.
Technical Mitigations AI-generated
• Implementing regular software updates and patches to prevent exploitation of vulnerabilities. • Enforcing strict access controls on cloud storage, including multi-factor authentication and least privilege principles. • Regularly monitoring for suspicious activity and implementing incident response plans to quickly contain and respond to security breaches.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 23 IoCs Create Free Account
dc•••••.local
th•••••.local
gp•••••.inf
sc•••••.xml
RE•••••.txt
he•••••.txt
ki•••••.exe
ki•••••.exe
010865••••••••••••••••••••••••••
bea5e2••••••••••••••••••••••••••
104.164.•••.•••
146.70.•••.•••
149.102.•••.•••
192.42.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation KillSwitchOperation KillSwitch BlackCatBlackCatRyukRyukALPHVALPHV
Target & Sectors
MIDDLE_EAST MIDDLE_EAST NORTH_AMERICA NORTH_AMERICA BENELUX BENELUX DACH DACH healthhealth manufacturingmanufacturing
Incident Timeline
‎April 2026
Threat actors used a ransomware attack to target the manufacturing organization in the Middle East.
industry Manufacturing
Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East.
target_region MIDDLE_EAST
Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East.
organisation Kaspersky’s Global Emergency Response Team
Executive summary In April 2026, we at Kaspersky’s Global Emergency Response Team (GERT) responded to a security incident at a manufacturing organization in the Middle East.
‎11 April
Threat actors used initial access to target KillSec, a ransomware group, on April 11.
‎13 April
Threat actors used a Group Policy Object (GPO) to target and exfiltrate data from endpoints on April 13, with the policy update being cached but not yet applied until the next day.
tactic Exfiltration
13 April Data exfiltration.
organisation MFT
Analysis of Master File Table (MFT) timestamps and the Group Policy History registry key confirmed the policy was written to SYSVOL and cached on endpoints on 13 April.
‎13 April Second GPO
Threat actors wrote the hello.txt and payload.jpg files to a compromised Windows system.
infrastructure Windows
The payload.jpg and hello.txt files written to \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\. 13 April Second GPO. GPO named win Firewall Off ({22099AD2-E062-4F56-B574-5099BBA4E7A6}) linked at the domain root, disabling Windows Firewall on all profiles.
observable hello.txt
The payload.jpg and hello.txt files written to \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\. 13 April Second GPO. GPO named win Firewall Off ({22099AD2-E062-4F56-B574-5099BBA4E7A6}) linked at the domain root, disabling Windows Firewall on all profiles.
organisation payload.jpg
The payload.jpg and hello.txt files written to \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\. 13 April Second GPO. GPO named win Firewall Off ({22099AD2-E062-4F56-B574-5099BBA4E7A6}) linked at the domain root, disabling Windows Firewall on all profiles.
‎13 April: HKLM\
The ransomware group, KillSec, applied the PAYLOAD payload to a Windows workstation on April 13.
general_metric 5 Event ID
Registry timeline analysis Group Policy History, Shadow and State registry keys on the workstation recorded the application of PAYLOAD on 13 April: HKLM\…\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\1 HKLM\…\Group Policy\Shadow\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\0 HKLM\…\Group Policy\State\Machine\GPO-List\7 HKCU\…\Group Policy\History\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}\1 HKCU\…\Group Policy\State\S-1-5-21-…\Loopback-GPO-List\5 The presence of the “Loopback-GPO-List” entry indicates the GPO was processed in loopback mode , ensuring the user configuration (wallpaper) applied regardless of which user logged on to the machine.
organisation State
Registry timeline analysis Group Policy History, Shadow and State registry keys on the workstation recorded the application of PAYLOAD on 13 April: HKLM\…\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\1 HKLM\…\Group Policy\Shadow\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\0 HKLM\…\Group Policy\State\Machine\GPO-List\7 HKCU\…\Group Policy\History\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}\1 HKCU\…\Group Policy\State\S-1-5-21-…\Loopback-GPO-List\5 The presence of the “Loopback-GPO-List” entry indicates the GPO was processed in loopback mode , ensuring the user configuration (wallpaper) applied regardless of which user logged on to the machine.
‎14 April
Threat actors used a one-day delay detonation to target the killSec ransomware group with an attack that was set to occur on April 14.
‎15 April
Threat actors behind the KillSec ransomware group were targeted by law enforcement with arrests and seizures on 15 April.
‎16 April Assessment
Threat actors behind the KillSec ransomware group were targeted by law enforcement with simultaneous arrests and seizures on 16 April.
‎August 2026
A 18-year-old suspected developer was indicted by US authorities in August 2026 on charges related to their alleged involvement with the KillSec ransomware group.
general_metric 18 developer
Others include a suspected developer who turned 18 in August 2026.
‎September 30
British police arrested Fouad Eltibrizi, aka Archduke, on September 30 for hacking and extortion-related offenses.
target_region United Kingdom
Fouad Eltibrizi (aka Archduke), was arrested on September 30 by British police and is charged with hacking and extortion-related offenses that carry a maximum sentence of 10 years behind bars.
tactic Extortion
Fouad Eltibrizi (aka Archduke), was arrested on September 30 by British police and is charged with hacking and extortion-related offenses that carry a maximum sentence of 10 years behind bars.
attribution Fouad Eltibrizi
Fouad Eltibrizi (aka Archduke), was arrested on September 30 by British police and is charged with hacking and extortion-related offenses that carry a maximum sentence of 10 years behind bars.
‎2026/10/02
Threat actors used a Group Policy Object (GPO) to hijack Windows systems, deliver ransom notes and disable the local administrator account across every domain-joined workstation.
organisation Group-IB
Group-IB, which was involved in the operation, identified 274 publicly claimed victims, most of which were US (35%) and Indian (17%) organizations.
victims 274 claimed victims
Group-IB, which was involved in the operation, identified 274 publicly claimed victims, most of which were US (35%) and Indian (17%) organizations.
infrastructure Fortigate
Insufficient logging on the FortiGate appliance prevented us from reconstructing how the credential was originally compromised.
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
FortiGate SSL VPN authentication logs and ESXi/virtualization privilege escalation logs were insufficient to reconstruct the lateral movement and privilege escalation chain between initial VPN access and the GPO write privilege level.
Threat actor authenticates to the FortiGate SSL VPN using a valid but compromised domain credential.
Incident overview Initial access The entry vector was a compromised valid account (MITRE ATT&CK T1078) used to authenticate through the organization’s FortiGate SSL VPN — an external remote service (T1133).
Implement enhanced, centrally collected FortiGate SSL VPN logging (auth events, session detail, source IP geolocation, impossible travel check) and detailed perimeter monitoring.
organisation RSOP
The PAYLOAD GPO We performed a Resultant Set of Policy (RSOP) analysis, which helped us list all policy settings on the affected workstations.
infrastructure Windows
Through that single object, the actor delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data.
Anti-forensics and recovery-inhibition capabilities Confirmed PAYLOAD family capabilities The Windows endpoint attack described in this report was implemented through malicious Group Policy Objects and did not involve a recovered ransomware executable, resident endpoint malware, confirmed file encryption or active malicious processes at the time of the forensic examination.
However, PAYLOAD cryptomalware for Windows does exist, and other sources, including public analysis of its samples, reveal further malicious capabilities of this ransomware that could be used by security teams to enrich detection logic and security policies.
The ransomware dynamically resolves Windows Event Log APIs, enumerates available event log channels, and clears individual channels.
Security process and service termination PAYLOAD analysis reveals that the Windows ransomware variant contains logic that targets security processes and services (T1685 and T1489).
Forensic indicators Execution of shadow copy management utilities Backup catalog deletion attempts Recovery configuration changes Backup service termination Mass snapshot deletions Backup administrator logons outside normal maintenance windows Backup retention or immutability changes Backup jobs failing immediately before disruptive activity Ecosystem-relevant ransomware techniques Above, we discussed the techniques specific to PAYLOAD ransomware.
Although the group used  Windows and VMware ESXi virtualization lockers, it didn’t always encrypt; stealing and extorting data on some occasions.
Forensic indicators Security agent services changing from running to stopped Event ID 7036 service state changes Event ID 7040 service start type changes Event ID 4688 or Sysmon Event ID 1 for service control utilities Sysmon Event ID 5 for terminated processes EDR health degradation affecting many endpoints Repeated termination attempts against security or backup processes Execution of dedicated process killing utilities VSS deletion, backup and recovery suppression Public PAYLOAD sample analysis reports the deletion of Windows Volume Shadow Copies before encryption (T1490).
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
We confirmed that no files were encrypted on Windows machines, no malicious binaries were resident on disk, no endpoint persistence was established, and no malicious processes were running at the time of analysis.
Registry (Computer) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption Welcome to Payload!
Modify the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ registry key, changing the legalnoticecaption value to "Welcome to Payload!" and the legalnoticetext to the ransom note text through the “Group Policy Registry” CSE.
The win Firewall Off GPO A second domain-root-linked GPO, named “win Firewall Off”, disabled Windows Firewall across the domain, private and public profiles on all endpoints (T1562.004).
Windows Event Log clearing Public reverse engineering of the PAYLOAD Windows variant reveals an optional event log clearing capability (T1685.005, formerly T1070.001).
However, it does not necessarily remove events that were already forwarded to a SIEM, Windows Event Collector, EDR backend, or protected log archive.
Forensic indicators Windows Security Event ID 1102 Event logging shutdown or failure events Sudden reductions in event record identifiers Multiple event channels restarting from low record numbers Gaps between endpoint and centrally forwarded telemetry Execution of utilities or APIs associated with log management Direct access to EVTX files (Windows Event Log files) under the Windows event log directory We should note that these indicators can’t be interpreted on their own.
For instance, Event ID 1102 should be correlated with a number of aggravating factors, such as: Event ID 4688 or Sysmon Event ID 1 for process creation Event ID 4624 for the associated administrative logon EDR process trees PowerShell operational logging Windows Event Forwarding records Privileged access management activity At the same time, the absence of Event ID 1102 does not prove that log clearing did not occur.
Recovery inhibition is broader than VSS deletion and may include multiple other malicious techniques, including the following: Deleting shadow copies, backup catalogs, and hypervisor snapshots Disabling recovery services Modifying boot recovery settings Compromising backup management platforms Deleting or encrypting backup repositories In the PAYLOAD Windows sample that is proven to perform encryption, VSS deletion is confirmed to have taken place before encryption.
ETW suppression and in-memory patching Event Tracing for Windows (ETW) is a kernel-supported tracing architecture used by Windows components, diagnostic utilities, security products, and endpoint monitoring systems.
It does not disable ETW globally across Windows, but it can reduce the telemetry generated by the modified process.
Forensic indicators Writable or recently modified executable pages within ntdll.dll Memory protection changes affecting ETW function addresses In-memory code differing from the corresponding clean DLL on disk EDR memory tampering alerts Unexpected calls to memory protection APIs followed by telemetry silence Process execution visible in network or filesystem telemetry but absent from expected ETW-derived sources Inconsistent telemetry between EDR, Sysmon, Windows Event Logs, and network monitoring It should be noted that telemetry gaps are not conclusive evidence of ETW patching.
Deploy Windows LAPS to generate unique, rotated local administrator passwords.
To ensure the detection rules function correctly, verify that events from Windows systems are being received in full, including events with the following identifiers: Sysmon: 11, Security — 4663, 5136, 4657.
Detection of Windows Event Log clearing to cover up traces of an attack: R050_03_Windows Event Log was cleared Detection of suspicious access to the LSASS process, which may indicate attempts to dump credentials: R262_Suspicious access to the LSASS process Detection of the Volume Shadow Copy service being started, which is used to create shadow copies before deleting them: R231_20_Running the Volume Shadow Copy service Detection of shadow copy deletion: R321_Shadow copy deletion Detection of Windows Defender disablement: R076_01_Windows Defender Antivirus was disabled Detection of attempts to disable or modify the system firewall: R240_03_Disabling system firewall via the registry Detection of a service installation from a non-system folder, which may indicate malware persistence techniques: R281_01_Installation of a service from a non-system folder For the rules in this list to function correctly, it is necessary to configure Security event auditing for event IDs 4663, 5136, 4657, 7036, and 1102.
infrastructure Linux
The only ransomware we found in this incident was PAYLOAD sample targeting ESXi on Linux servers.
Public research typically describes operators performing the following activities (T1685, T1490 and T1489): Enabling SSH on ESXi hosts Changing root passwords Disabling execInstalledOnly Modifying lockdown mode exceptions Stopping virtual machines Deleting snapshots and backups Changing host firewall policies Copying custom ransomware binaries to hypervisors On the target organization’s Linux servers we saw an ESXi PAYLOAD variant, which makes this behavior operationally relevant.
organisation Microsoft
Microsoft observed Ryuk operators distributing ransomware through Group Policy, SYSVOL startup items, and PsExec.
organisation PsExec
Microsoft observed Ryuk operators distributing ransomware through Group Policy, SYSVOL startup items, and PsExec.
organisation LockBit
LockBit affiliates have been documented modifying SYSVOL Group Policy files, including ScheduledTasks.xml, to support ransomware execution and propagation.
organisation SYSVOL Group
LockBit affiliates have been documented modifying SYSVOL Group Policy files, including ScheduledTasks.xml, to support ransomware execution and propagation.
organisation GPO Preferences
Another notable example of GPO abuse is PAYLOAD ransomware, which weaponizes GPO Preferences and policy settings for pure impact rather than as a launcher for an encryptor.
organisation Backup
Forensic indicators Execution of shadow copy management utilities Backup catalog deletion attempts Recovery configuration changes Backup service termination Mass snapshot deletions Backup administrator logons outside normal maintenance windows Backup retention or immutability changes Backup jobs failing immediately before disruptive activity Ecosystem-relevant ransomware techniques Above, we discussed the techniques specific to PAYLOAD ransomware.
organisation BYOVD
BYOVD is highly relevant to contemporary ransomware operations.
organisation Ransomware
Forensic indicators Unexpected .sys files written to user-writable or temporary directories New kernel driver services Sysmon Event ID 6 Driver hashes matching Microsoft or community vulnerable driver blocklists Invalid, revoked, expired, or unusual driver signatures Driver load followed by EDR termination New privileged processes immediately following driver loading Code Integrity or Defender alerts Service creation events referencing driver files ESXi security policy weakening Ransomware operators are increasingly targeting ESXi and vCenter because compromising the virtualization layer provides access to many business-critical virtual machines.
organisation Sysmon Event ID 6
Forensic indicators Unexpected .sys files written to user-writable or temporary directories New kernel driver services Sysmon Event ID 6 Driver hashes matching Microsoft or community vulnerable driver blocklists Invalid, revoked, expired, or unusual driver signatures Driver load followed by EDR termination New privileged processes immediately following driver loading Code Integrity or Defender alerts Service creation events referencing driver files ESXi security policy weakening Ransomware operators are increasingly targeting ESXi and vCenter because compromising the virtualization layer provides access to many business-critical virtual machines.
organisation Invalid
Forensic indicators Unexpected .sys files written to user-writable or temporary directories New kernel driver services Sysmon Event ID 6 Driver hashes matching Microsoft or community vulnerable driver blocklists Invalid, revoked, expired, or unusual driver signatures Driver load followed by EDR termination New privileged processes immediately following driver loading Code Integrity or Defender alerts Service creation events referencing driver files ESXi security policy weakening Ransomware operators are increasingly targeting ESXi and vCenter because compromising the virtualization layer provides access to many business-critical virtual machines.
organisation Driver
Forensic indicators Unexpected .sys files written to user-writable or temporary directories New kernel driver services Sysmon Event ID 6 Driver hashes matching Microsoft or community vulnerable driver blocklists Invalid, revoked, expired, or unusual driver signatures Driver load followed by EDR termination New privileged processes immediately following driver loading Code Integrity or Defender alerts Service creation events referencing driver files ESXi security policy weakening Ransomware operators are increasingly targeting ESXi and vCenter because compromising the virtualization layer provides access to many business-critical virtual machines.
organisation Code Integrity
Forensic indicators Unexpected .sys files written to user-writable or temporary directories New kernel driver services Sysmon Event ID 6 Driver hashes matching Microsoft or community vulnerable driver blocklists Invalid, revoked, expired, or unusual driver signatures Driver load followed by EDR termination New privileged processes immediately following driver loading Code Integrity or Defender alerts Service creation events referencing driver files ESXi security policy weakening Ransomware operators are increasingly targeting ESXi and vCenter because compromising the virtualization layer provides access to many business-critical virtual machines.
organisation OOTB] Group
[OOTB] Group policy hijacked: PAYLOAD ransomware – ENG.
organisation ENG
[OOTB] Group policy hijacked: PAYLOAD ransomware – ENG.
data_breach 110 TB
Led by German police, Operation KillSwitch saw law enforcers seize the group’s leak site and prevent at least 110TB of stolen data from being exposed, it explained.
organisation VMware
Although the group used  Windows and VMware ESXi virtualization lockers, it didn’t always encrypt; stealing and extorting data on some occasions.
organisation Event ID 7036
Forensic indicators Security agent services changing from running to stopped Event ID 7036 service state changes Event ID 7040 service start type changes Event ID 4688 or Sysmon Event ID 1 for service control utilities Sysmon Event ID 5 for terminated processes EDR health degradation affecting many endpoints Repeated termination attempts against security or backup processes Execution of dedicated process killing utilities VSS deletion, backup and recovery suppression Public PAYLOAD sample analysis reports the deletion of Windows Volume Shadow Copies before encryption (T1490).
organisation Sysmon Event ID 5
Forensic indicators Security agent services changing from running to stopped Event ID 7036 service state changes Event ID 7040 service start type changes Event ID 4688 or Sysmon Event ID 1 for service control utilities Sysmon Event ID 5 for terminated processes EDR health degradation affecting many endpoints Repeated termination attempts against security or backup processes Execution of dedicated process killing utilities VSS deletion, backup and recovery suppression Public PAYLOAD sample analysis reports the deletion of Windows Volume Shadow Copies before encryption (T1490).
organisation Windows Volume Shadow Copies
Forensic indicators Security agent services changing from running to stopped Event ID 7036 service state changes Event ID 7040 service start type changes Event ID 4688 or Sysmon Event ID 1 for service control utilities Sysmon Event ID 5 for terminated processes EDR health degradation affecting many endpoints Repeated termination attempts against security or backup processes Execution of dedicated process killing utilities VSS deletion, backup and recovery suppression Public PAYLOAD sample analysis reports the deletion of Windows Volume Shadow Copies before encryption (T1490).
organisation Initial Access
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
organisation Initial Access T1133
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
organisation Privilege Escalation T1078.002
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
organisation Windows Firewall
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
organisation GPO Security
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
organisation Command
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
organisation Registry (Computer
Registry (Computer) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption Welcome to Payload!
organisation Modify
Modify the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ registry key, changing the legalnoticecaption value to "Welcome to Payload!" and the legalnoticetext to the ransom note text through the “Group Policy Registry” CSE.
organisation the “Group Policy Registry
Modify the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ registry key, changing the legalnoticecaption value to "Welcome to Payload!" and the legalnoticetext to the ransom note text through the “Group Policy Registry” CSE.
organisation Firewall Off GPO
The win Firewall Off GPO A second domain-root-linked GPO, named “win Firewall Off”, disabled Windows Firewall across the domain, private and public profiles on all endpoints (T1562.004).
organisation Windows Event Log
Windows Event Log clearing Public reverse engineering of the PAYLOAD Windows variant reveals an optional event log clearing capability (T1685.005, formerly T1070.001).
organisation Windows Event Collector
However, it does not necessarily remove events that were already forwarded to a SIEM, Windows Event Collector, EDR backend, or protected log archive.
organisation EDR
However, it does not necessarily remove events that were already forwarded to a SIEM, Windows Event Collector, EDR backend, or protected log archive.
organisation Windows Security Event ID
Forensic indicators Windows Security Event ID 1102 Event logging shutdown or failure events Sudden reductions in event record identifiers Multiple event channels restarting from low record numbers Gaps between endpoint and centrally forwarded telemetry Execution of utilities or APIs associated with log management Direct access to EVTX files (Windows Event Log files) under the Windows event log directory We should note that these indicators can’t be interpreted on their own.
organisation Event ID 1102
For instance, Event ID 1102 should be correlated with a number of aggravating factors, such as: Event ID 4688 or Sysmon Event ID 1 for process creation Event ID 4624 for the associated administrative logon EDR process trees PowerShell operational logging Windows Event Forwarding records Privileged access management activity At the same time, the absence of Event ID 1102 does not prove that log clearing did not occur.
organisation Sysmon Event ID 1
For instance, Event ID 1102 should be correlated with a number of aggravating factors, such as: Event ID 4688 or Sysmon Event ID 1 for process creation Event ID 4624 for the associated administrative logon EDR process trees PowerShell operational logging Windows Event Forwarding records Privileged access management activity At the same time, the absence of Event ID 1102 does not prove that log clearing did not occur.
organisation VSS
Recovery inhibition is broader than VSS deletion and may include multiple other malicious techniques, including the following: Deleting shadow copies, backup catalogs, and hypervisor snapshots Disabling recovery services Modifying boot recovery settings Compromising backup management platforms Deleting or encrypting backup repositories In the PAYLOAD Windows sample that is proven to perform encryption, VSS deletion is confirmed to have taken place before encryption.
organisation ETW
ETW suppression and in-memory patching Event Tracing for Windows (ETW) is a kernel-supported tracing architecture used by Windows components, diagnostic utilities, security products, and endpoint monitoring systems.
organisation Event Tracing for
ETW suppression and in-memory patching Event Tracing for Windows (ETW) is a kernel-supported tracing architecture used by Windows components, diagnostic utilities, security products, and endpoint monitoring systems.
organisation DLL
Forensic indicators Writable or recently modified executable pages within ntdll.dll Memory protection changes affecting ETW function addresses In-memory code differing from the corresponding clean DLL on disk EDR memory tampering alerts Unexpected calls to memory protection APIs followed by telemetry silence Process execution visible in network or filesystem telemetry but absent from expected ETW-derived sources Inconsistent telemetry between EDR, Sysmon, Windows Event Logs, and network monitoring It should be noted that telemetry gaps are not conclusive evidence of ETW patching.
organisation Unexpected
Forensic indicators Writable or recently modified executable pages within ntdll.dll Memory protection changes affecting ETW function addresses In-memory code differing from the corresponding clean DLL on disk EDR memory tampering alerts Unexpected calls to memory protection APIs followed by telemetry silence Process execution visible in network or filesystem telemetry but absent from expected ETW-derived sources Inconsistent telemetry between EDR, Sysmon, Windows Event Logs, and network monitoring It should be noted that telemetry gaps are not conclusive evidence of ETW patching.
organisation Sysmon
Forensic indicators Writable or recently modified executable pages within ntdll.dll Memory protection changes affecting ETW function addresses In-memory code differing from the corresponding clean DLL on disk EDR memory tampering alerts Unexpected calls to memory protection APIs followed by telemetry silence Process execution visible in network or filesystem telemetry but absent from expected ETW-derived sources Inconsistent telemetry between EDR, Sysmon, Windows Event Logs, and network monitoring It should be noted that telemetry gaps are not conclusive evidence of ETW patching.
organisation Windows Event Logs
Forensic indicators Writable or recently modified executable pages within ntdll.dll Memory protection changes affecting ETW function addresses In-memory code differing from the corresponding clean DLL on disk EDR memory tampering alerts Unexpected calls to memory protection APIs followed by telemetry silence Process execution visible in network or filesystem telemetry but absent from expected ETW-derived sources Inconsistent telemetry between EDR, Sysmon, Windows Event Logs, and network monitoring It should be noted that telemetry gaps are not conclusive evidence of ETW patching.
organisation Deploy Windows LAPS
Deploy Windows LAPS to generate unique, rotated local administrator passwords.
organisation Detection of Windows Event Log
Detection of Windows Event Log clearing to cover up traces of an attack: R050_03_Windows Event Log was cleared Detection of suspicious access to the LSASS process, which may indicate attempts to dump credentials: R262_Suspicious access to the LSASS process Detection of the Volume Shadow Copy service being started, which is used to create shadow copies before deleting them: R231_20_Running the Volume Shadow Copy service Detection of shadow copy deletion: R321_Shadow copy deletion Detection of Windows Defender disablement: R076_01_Windows Defender Antivirus was disabled Detection of attempts to disable or modify the system firewall: R240_03_Disabling system firewall via the registry Detection of a service installation from a non-system folder, which may indicate malware persistence techniques: R281_01_Installation of a service from a non-system folder For the rules in this list to function correctly, it is necessary to configure Security event auditing for event IDs 4663, 5136, 4657, 7036, and 1102.
organisation KillSec
KillSec has been in operation since 2024 and carried out at least 500 successful attacks in that time, although it is responsible for twice that number, according to Europol.
organisation Europol
KillSec has been in operation since 2024 and carried out at least 500 successful attacks in that time, although it is responsible for twice that number, according to Europol.
organisation Group
KillSec's operations depended on a small core team that developed the locker and approved each build, Group-IB claimed.
organisation FortiGate SSL VPN
FortiGate SSL VPN authentication logs and ESXi/virtualization privilege escalation logs were insufficient to reconstruct the lateral movement and privilege escalation chain between initial VPN access and the GPO write privilege level.
organisation SSL
Three hypotheses were considered plausible in the context of the attack, in no particular order: Password spraying or credential stuffing against the SSL VPN portal.
organisation MFA
Phase 3 — credential and access hardening Enforce phishing-resistant MFA on all VPN and remote access entry points.
organisation Source SYSVOL\hello.txt → Desktop
Source SYSVOL\hello.txt → Desktop, C:\, D:\ Dropped as README-payload.txt (ReadOnly)
organisation the “Group Policy Files
Registry (Computer) HKLM\…\Policies\System\legalnoticetext (ransom demand text) Personalization Policy Lock Screen Image \\DC.THECOMPANY.local\sysvol…\payload.jpg Desktop Policy (User) Wallpaper path \\DC.THECOMPANY.local\sysvol…\payload.jpg Security Settings (GptTmpl.inf) Accounts: Administrator account status Disabled The PAYLOAD GPO enabled the following actions: Drop SYSVOL\hello.txt to the desktop and root directories C:\ and D:\ as a read-only README-payload.txt by tampering with the “Group Policy Files” client-side extension (CSE).
organisation Rotate
Delete jpg and hello.txt from \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\. Rotate credentials.
organisation Set payload.jpg
Set payload.jpg located in the targeted domain controller’s SYSVOL as the lock screen image by altering the personalization policy, and as the wallpaper by altering the desktop policy at the user level.
organisation the Files Group Policy Preference CSE
SYSVOL artifacts Two files were staged on the domain controller’s SYSVOL share and served to endpoints through the Files Group Policy Preference CSE: payload.jpg — the ransom image used for both wallpaper and lock screen.
organisation Enumeration of Security, System, Application
Implementation artifacts include: Runtime loading of wevtapi.dll EvtOpenChannelEnum EvtNextChannelPath EvtClearLog Enumeration of Security, System, Application, and PowerShell logs, and operational channels A command-line option controlling whether log clearing is performed Clearing event logs reduces the availability of records related to process execution, authentication, PowerShell, service control, and system changes.
organisation IP
Ransom note dropped to desktops and drive roots killer.exe ( 0108656A3E1ADE6CA4F21B084F5E1208 ): process killer tool kill.exe ( BEA5E267F24D7DA59F6821BFFDBFF293 ): process killer tool IP addresses 37.19.210[.]12 146.70.117[.]239 149.102.229[.]154 104.164.55[.]46 104.28.162[.]228 104.28.163[.]162 64.190.76[.]14 192.42.116[.]50 192.42.116[.]12 192.42.116[.]56 192.42.116[.]97 192.42.116[.]52 Registry keys HKLM\...
organisation Group Policy Object
The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root.
organisation GPO
The threat actor obtained domain admin-equivalent control of the organization’s Active Directory environment and authored a malicious Group Policy Object (GPO) named PAYLOAD, linking it at the domain root.
organisation Active Directory
The entire attack lived inside Active Directory itself.
organisation Group Policy
Group Policy as an attack surface Attacks through group policies are nothing new.
organisation GPC
A Group Policy Object (GPO) is essentially a combination of a Group Policy Container (GPC) in Active Directory and a Group Policy Template (GPT) in SYSVOL.
organisation GPT
A Group Policy Object (GPO) is essentially a combination of a Group Policy Container (GPC) in Active Directory and a Group Policy Template (GPT) in SYSVOL.
organisation SYSVOL
A Group Policy Object (GPO) is essentially a combination of a Group Policy Container (GPC) in Active Directory and a Group Policy Template (GPT) in SYSVOL.
organisation Ransom
Ransom wallpaper, logon banner, and notes appear.
organisation IAB
Purchase of pre-compromised credentials from an initial access broker (IAB).
organisation Group Policy Creator Owners
Because the account was able to create and link a GPO at the domain root, it held either domain admin privileges or a delegated equivalent (e.g., membership of Group Policy Creator Owners combined with link rights on the domain object).
organisation CSE
From these results, we reconstructed the following changes delivered by PAYLOAD: GPO extension/CSE Setting/path Configured value/resulting action Files (Group Policy Preference)
organisation Files (Group Policy Preference
From these results, we reconstructed the following changes delivered by PAYLOAD: GPO extension/CSE Setting/path Configured value/resulting action Files (Group Policy Preference)
organisation PAYLOAD GPO
Settings changed by PAYLOAD GPO This activity was enabled entirely through a legitimate group policy mechanism, meaning there is no malware code for security solutions to look for because the malicious logic is contained within the policy configuration.
organisation PAYLOAD
Deployed independently of PAYLOAD, this object degraded host defenses and ensured the actor retained unimpeded network reach to endpoints for any follow-on activity.
organisation Run/RunOnce
No endpoint persistence All standard persistence locations were clean: Scheduled tasks — no malicious tasks Run/RunOnce keys — clean Startup folders (user and system) — clean Services — no malicious service installed WMI event subscriptions — none Boot sector/MBR — unmodified The attack’s persistence mechanism is the GPO link itself on the domain controller, with no endpoint-resident component.
organisation WMI
No endpoint persistence All standard persistence locations were clean: Scheduled tasks — no malicious tasks Run/RunOnce keys — clean Startup folders (user and system) — clean Services — no malicious service installed WMI event subscriptions — none Boot sector/MBR — unmodified The attack’s persistence mechanism is the GPO link itself on the domain controller, with no endpoint-resident component.
organisation MBR
No endpoint persistence All standard persistence locations were clean: Scheduled tasks — no malicious tasks Run/RunOnce keys — clean Startup folders (user and system) — clean Services — no malicious service installed WMI event subscriptions — none Boot sector/MBR — unmodified The attack’s persistence mechanism is the GPO link itself on the domain controller, with no endpoint-resident component.
organisation vCenter
However, these techniques should not be attributed to this incident without supporting driver load, process, memory, ESXi, vCenter, or backup platform telemetry.
organisation EtwRegister
Reported target functions include EtwEventWrite , EtwEventWriteFull , EtwEventWriteTransfer , and EtwRegister .
organisation Bulk VM
Forensic indicators Unexpected ESXi SSH enablement Changes to execInstalledOnly Secure Boot enforcement changes Lockdown mode configuration changes Root password changes New or unusual administrator accounts Bulk VM shutdown activity Bulk snapshot deletion New binaries in datastore or temporary paths vCenter tasks originating from unexpected accounts or systems Missing or disabled remote syslog forwarding
organisation Delete
Delete or revert win Firewall Off GPO.
organisation Clean SYSVOL
Clean SYSVOL.
organisation Adopt Privileged Access Workstations
Adopt Privileged Access Workstations (PAW) for all administration.
organisation PAW
Adopt Privileged Access Workstations (PAW) for all administration.
organisation Privileged Identity Management
Implement just-in-time elevation through Privileged Identity Management (PIM) for domain admin.
organisation PIM
Implement just-in-time elevation through Privileged Identity Management (PIM) for domain admin.
organisation Kaspersky
Detection by Kaspersky solutions Kaspersky security solutions effectively detect the described malicious activity at various stages of the attack.
organisation Kaspersky SIEM
To protect organizations that use our Kaspersky SIEM system, we have prepared a package of correlation rules designed to help detect this type of malicious activity.
organisation Kaspersky Endpoint Detection and
In addition to the SIEM system, when audit settings are configured correctly, the process of creating, modifying, and deleting GPOs generates a large number of characteristic artifacts on the domain controller, enabling Kaspersky Endpoint Detection and Response Expert to promptly alert the user to anomalies in the infrastructure.
organisation Kaspersky EDR Expert
In the next major version update of Kaspersky EDR Expert, a new event type, GPO, will be introduced, allowing users to track changes to Group Policy Objects.
Tactical Metrics
Metrics
victims
274
Claimed Victims
Group-IB, which was involved in the operation, identified 274 publicly claimed victims, most of which were US (35%) and Indian (17%) organizations.
Metrics
data_breach
110
Tb
Led by German police, Operation KillSwitch saw law enforcers seize the group’s leak site and prevent at least 110TB of stolen data from being exposed, it explained.
Metrics
infrastructure
‎Windows
Affected Product
Although the group used  Windows and VMware ESXi virtualization lockers, it didn’t always encrypt; stealing and extorting data on some occasions.
Forensic indicators Security agent services changing from running to stopped Event ID 7036 service state changes Event ID 7040 service start type changes Event ID 4688 or Sysmon Event ID 1 for service control utilities Sysmon Event ID 5 for terminated processes EDR health degradation affecting many endpoints Repeated termination attempts against security or backup processes Execution of dedicated process killing utilities VSS deletion, backup and recovery suppression Public PAYLOAD sample analysis reports the deletion of Windows Volume Shadow Copies before encryption (T1490).
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
Through that single object, the actor delivered ransom notes, hijacked the desktop wallpaper and lock screen, enforced a logon banner, and disabled the local administrator account across every domain-joined Windows workstation — all without dropping a ransomware binary or encrypting any data.
Anti-forensics and recovery-inhibition capabilities Confirmed PAYLOAD family capabilities The Windows endpoint attack described in this report was implemented through malicious Group Policy Objects and did not involve a recovered ransomware executable, resident endpoint malware, confirmed file encryption or active malicious processes at the time of the forensic examination.
However, PAYLOAD cryptomalware for Windows does exist, and other sources, including public analysis of its samples, reveal further malicious capabilities of this ransomware that could be used by security teams to enrich detection logic and security policies.
The ransomware dynamically resolves Windows Event Log APIs, enumerates available event log channels, and clears individual channels.
Security process and service termination PAYLOAD analysis reveals that the Windows ransomware variant contains logic that targets security processes and services (T1685 and T1489).
Forensic indicators Execution of shadow copy management utilities Backup catalog deletion attempts Recovery configuration changes Backup service termination Mass snapshot deletions Backup administrator logons outside normal maintenance windows Backup retention or immutability changes Backup jobs failing immediately before disruptive activity Ecosystem-relevant ransomware techniques Above, we discussed the techniques specific to PAYLOAD ransomware.
We confirmed that no files were encrypted on Windows machines, no malicious binaries were resident on disk, no endpoint persistence was established, and no malicious processes were running at the time of analysis.
The payload.jpg and hello.txt files written to \\DC.THECOMPANY.local\sysvol\THECOMPANY.local\. 13 April Second GPO. GPO named win Firewall Off ({22099AD2-E062-4F56-B574-5099BBA4E7A6}) linked at the domain root, disabling Windows Firewall on all profiles.
Registry (Computer) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption Welcome to Payload!
Modify the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ registry key, changing the legalnoticecaption value to "Welcome to Payload!" and the legalnoticetext to the ransom note text through the “Group Policy Registry” CSE.
The win Firewall Off GPO A second domain-root-linked GPO, named “win Firewall Off”, disabled Windows Firewall across the domain, private and public profiles on all endpoints (T1562.004).
Windows Event Log clearing Public reverse engineering of the PAYLOAD Windows variant reveals an optional event log clearing capability (T1685.005, formerly T1070.001).
However, it does not necessarily remove events that were already forwarded to a SIEM, Windows Event Collector, EDR backend, or protected log archive.
Forensic indicators Windows Security Event ID 1102 Event logging shutdown or failure events Sudden reductions in event record identifiers Multiple event channels restarting from low record numbers Gaps between endpoint and centrally forwarded telemetry Execution of utilities or APIs associated with log management Direct access to EVTX files (Windows Event Log files) under the Windows event log directory We should note that these indicators can’t be interpreted on their own.
For instance, Event ID 1102 should be correlated with a number of aggravating factors, such as: Event ID 4688 or Sysmon Event ID 1 for process creation Event ID 4624 for the associated administrative logon EDR process trees PowerShell operational logging Windows Event Forwarding records Privileged access management activity At the same time, the absence of Event ID 1102 does not prove that log clearing did not occur.
Recovery inhibition is broader than VSS deletion and may include multiple other malicious techniques, including the following: Deleting shadow copies, backup catalogs, and hypervisor snapshots Disabling recovery services Modifying boot recovery settings Compromising backup management platforms Deleting or encrypting backup repositories In the PAYLOAD Windows sample that is proven to perform encryption, VSS deletion is confirmed to have taken place before encryption.
ETW suppression and in-memory patching Event Tracing for Windows (ETW) is a kernel-supported tracing architecture used by Windows components, diagnostic utilities, security products, and endpoint monitoring systems.
It does not disable ETW globally across Windows, but it can reduce the telemetry generated by the modified process.
Forensic indicators Writable or recently modified executable pages within ntdll.dll Memory protection changes affecting ETW function addresses In-memory code differing from the corresponding clean DLL on disk EDR memory tampering alerts Unexpected calls to memory protection APIs followed by telemetry silence Process execution visible in network or filesystem telemetry but absent from expected ETW-derived sources Inconsistent telemetry between EDR, Sysmon, Windows Event Logs, and network monitoring It should be noted that telemetry gaps are not conclusive evidence of ETW patching.
Deploy Windows LAPS to generate unique, rotated local administrator passwords.
To ensure the detection rules function correctly, verify that events from Windows systems are being received in full, including events with the following identifiers: Sysmon: 11, Security — 4663, 5136, 4657.
Detection of Windows Event Log clearing to cover up traces of an attack: R050_03_Windows Event Log was cleared Detection of suspicious access to the LSASS process, which may indicate attempts to dump credentials: R262_Suspicious access to the LSASS process Detection of the Volume Shadow Copy service being started, which is used to create shadow copies before deleting them: R231_20_Running the Volume Shadow Copy service Detection of shadow copy deletion: R321_Shadow copy deletion Detection of Windows Defender disablement: R076_01_Windows Defender Antivirus was disabled Detection of attempts to disable or modify the system firewall: R240_03_Disabling system firewall via the registry Detection of a service installation from a non-system folder, which may indicate malware persistence techniques: R281_01_Installation of a service from a non-system folder For the rules in this list to function correctly, it is necessary to configure Security event auditing for event IDs 4663, 5136, 4657, 7036, and 1102.
Metrics
infrastructure
‎Fortigate
Affected Product
Insufficient logging on the FortiGate appliance prevented us from reconstructing how the credential was originally compromised.
MITRE ATT&CK mapping Tactic Technique Observed behavior Initial Access T1078 — Valid Accounts Compromised domain credential used for VPN authentication Initial Access T1133 — External Remote Services FortiGate SSL VPN used as entry point Privilege Escalation T1078.002 — Domain Accounts Account held domain-level GPO create/link rights Privilege Escalation/Defense Impairment T1484.001 — Group Policy Modification Malicious PAYLOAD GPO created and linked at domain root; re-applies on every refresh/reboot; uses trusted channel to evade EDR Defense Impairment T1686 — Disable or Modify System Firewall win Firewall Off GPO disables Windows Firewall on all profiles Impact T1491.001 — Internal Defacement Wallpaper and lock screen replaced with ransom image Impact T1531 — Account Access Removal Local Administrator account disabled via GPO Security Settings Collection T1005 — Data from Local System Data exfiltration was observed originating from the file servers Command and Control
FortiGate SSL VPN authentication logs and ESXi/virtualization privilege escalation logs were insufficient to reconstruct the lateral movement and privilege escalation chain between initial VPN access and the GPO write privilege level.
Threat actor authenticates to the FortiGate SSL VPN using a valid but compromised domain credential.
Incident overview Initial access The entry vector was a compromised valid account (MITRE ATT&CK T1078) used to authenticate through the organization’s FortiGate SSL VPN — an external remote service (T1133).
Implement enhanced, centrally collected FortiGate SSL VPN logging (auth events, session detail, source IP geolocation, impossible travel check) and detailed perimeter monitoring.
Metrics
infrastructure
‎Linux
Affected Product
The only ransomware we found in this incident was PAYLOAD sample targeting ESXi on Linux servers.
Public research typically describes operators performing the following activities (T1685, T1490 and T1489): Enabling SSH on ESXi hosts Changing root passwords Disabling execInstalledOnly Modifying lockdown mode exceptions Stopping virtual machines Deleting snapshots and backups Changing host firewall policies Copying custom ransomware binaries to hypervisors On the target organization’s Linux servers we saw an ESXi PAYLOAD variant, which makes this behavior operationally relevant.
Intelligence Sources
Kaspersky 2026-09-21
Infosecurity-Magazine 2026-10-02