PAYLOAD ransomware attacks through Active Directory GPO | Securelist

A threat actor weaponized Active Directory Group Policy to achieve domain-wide ransomware-like disruption and extortion—without deploying malware or encrypting data—highlighting the urgent need for detection strategies beyond traditional file- and process-based indicators.