Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

MITRE Techniques

• [T1078 ] Valid Accounts – The attacker authenticated to the FortiGate SSL VPN using a compromised legitimate credential (‘initial access through a valid but compromised domain credential’).
• [T1133 ] External Remote Services – FortiGate SSL VPN was used as the entry point into the environment (‘authenticate through the organization’s FortiGate SSL VPN’).
• [T1078.002 ] Domain Accounts – The compromised account had domain-level rights to create and link GPOs (‘able to create and link a GPO at the domain root’).
• [T1484.001 ] Group Policy Modification – Malicious PAYLOAD GPO was created and linked at the domain root to deliver impact (‘malicious GPO, PAYLOAD, created and linked at the domain root’).
• [T1562.004 ] Disable or Modify System Firewall – The win Firewall Off GPO disabled Windows Firewall on all profiles (‘disabled Windows Firewall across the domain’).
• [T1491.001 ] Internal Defacement – Wallpaper and lock screen were replaced with a ransom image (‘ransom wallpaper, logon banner, and notes appear’).
• [T1531 ] Account Access Removal – The local Administrator account was disabled through GPO Security Settings (‘administrator account status Disabled’).
• [T1005 ] Data from Local System – Data exfiltration was observed from file servers and additional systems (‘Data exfiltration was observed originating from the file servers’).
• [T1685.005 ] Indicator Removal on Host: Clear Windows Event Logs – Public PAYLOAD samples can clear event logs to reduce forensic visibility (‘clears individual channels’).
• [T1685 ] Indicator Removal on Host – PAYLOAD analysis describes security process/service termination and ETW suppression capabilities (‘targets security processes and services’, ‘patch ETW-related functions’).
• [T1489 ] Service Stop – PAYLOAD samples may terminate services to interrupt protection and recovery (‘targets security processes and services’).
• [T1490 ] Inhibit System Recovery – Public PAYLOAD sample analysis reports deletion of Volume Shadow Copies before encryption (‘deletion of Windows Volume Shadow Copies before encryption’).
• [T1068 ] Exploitation for Privilege Escalation – BYOVD is described as a vulnerable-driver path to kernel-level control (‘introducing or abusing a legitimately signed but vulnerable kernel driver’).