New Kaspersky report highlights a growing trend of "encryptionless extortion"
Kaspersky’s Global Emergency Response Team (GERT) has published a new report analyzing a sophisticated new tactic in the Payload ransomware family. Discovered during an incident response at a manufacturing company in the Middle East, this attack demonstrates a major shift in cybercrime: the attackers took complete control of the company's network and forced its computers to lock up, display ransom notes, and change desktop wallpapers – all without deploying a conventional ransomware encryptor.
This incident illustrates one of the trends mentioned in Kaspersky’s State of Ransomware 2026 report released earlier this year: attackers are increasingly moving away from traditional file encryption. Instead, they are adopting “encryptionless extortion” - focusing on immediate operational disruption and leaking sensitive, stolen data on the dark web rather than relying on cryptographic keys to squeeze payments out of victims.
Initial infection: Slipping through the front door
Rather than using complex malware viruses to break into the network, the attackers bypassed initial defenses by acquiring administrator rights. Likely via phishing, they obtained highly privileged user credentials, which they then used to log directly into the corporate network through standard remote-access and VPN entry points. All of this went undetected, with the attackers appearing to security monitors as legitimate IT staff logging in for routine tasks.
Attack evolution: Weaponizing the network’s own rules
The intruders used the company’s own trusted administrative tools to further execute their attack. They targeted the company’s Active Directory (the backbone of a corporate network) and created a malicious Group Policy Object (GPO) rule.
GPOs are used by network administrators to instantly configure settings across thousands of employee computers. Because Group Policy is a legitimate and highly privileged administrative mechanism, malicious changes performed using compromised privileged accounts can resemble legitimate IT activity. By executing the entire attack inside a malicious GPO rule which they named "PAYLOAD," the hackers operated in complete silence. The rule instantly disabled local administrator accounts, pushed out ransom notes, and hijacked every computer's desktop wallpaper and lock screen to display a ransom graphic the moment the systems processed the updated policies.
Data exfiltration to the Dark web
The attackers focused their efforts on exfiltrating valuable corporate assets. Once the theft was complete and the administrative lockouts were triggered, the exfiltrated data was ultimately published on the dark web to finalize the extortion attempt.
"The tactics behind PAYLOAD represent another development in cybercriminal tactics. When attackers hijack central network rules, traditional endpoint malware scanning alone may be insufficient while the malicious Group Policy remains active. Organizations must prioritize blocking the malicious policies at the source, strictly locking down administrative credentials, and shifting their defense to monitoring behavior rather than just scanning for malware,” comments Elsayed Elrefaei, a security expert at Kaspersky Global Emergency Response Team.
The full report is available on Securelist.
Kaspersky recommends the following security measures to counter similar threats:
- Network administrators should closely monitor all GPO creations and modifications. Security alerts should be configured to trigger the moment a new rule is linked to the root of the corporate network.
- Ensure that any access to the network's administrative systems and VPN entry points requires highly secure, phishing-resistant multi-factor authentication (for instance, physical security keys).
- Enforce strict administrative boundaries. General IT administrators
should not have "master keys" that can access every workstation and
server simultaneously. Limit highly privileged "Domain Admin"
accounts strictly to dedicated, isolated systems.
