Full Report
Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objects.
Analysis Summary
# Incident Report: Binary-less Ransomware via GPO Abuse
## Executive Summary
This incident involved a highly sophisticated "encryptionless" ransomware attack where threat actors abused legitimate Active Directory (AD) mechanisms to lock out a victim organization. Instead of deploying custom malware or binary encryptors, the attackers leveraged Group Policy Objects (GPO) to change user passwords and restrict access across the domain. The primary impact was a total operational shutdown achieved through native Windows administration tools rather than traditional malicious payloads.
## Incident Details
- **Discovery Date:** Not explicitly disclosed (Analyzed by Kaspersky GERT)
- **Incident Date:** Circa 2024
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Global / Multiple (Observed in diverse environments)
## Timeline of Events
### Initial Access
- **Date/Time:** T-0
- **Vector:** Compromised credentials (likely via phishing or IAB purchase).
- **Details:** Attackers gained access to a domain account with sufficient privileges to interact with Active Directory.
### Lateral Movement
- **Details:** The threat actors moved laterally by leveraging existing administrative tools. They targeted Domain Controllers to gain control over the Group Policy Management Console (GPMC).
### Data Exfiltration/Impact
- **Impact:** The attackers did not encrypt files. Instead, they modified GPOs to:
1. Force a mass password reset for all domain users.
2. Change the desktop wallpaper to a ransom note.
3. Disable local administrative tools (CMD, Task Manager) to prevent recovery.
### Detection & Response
- **Discovery:** Employees were unable to log in to their workstations, and the ransom note appeared as the default background.
- **Response:** The organization engaged Kaspersky GERT for technical analysis and AD recovery.
## Attack Methodology
- **Initial Access:** Valid Accounts.
- **Persistence:** Creation of new GPOs that ensure settings are reapplied every 90 minutes.
- **Privilege Escalation:** Domain Administrator privileges (required to edit GPOs).
- **Defense Evasion:** Binary-less/Living-off-the-Land (LotL). No malicious files were dropped, bypassing traditional AV/EDR signatures.
- **Credential Access:** Domain-wide password reset via GPO "Immediate Task."
- **Discovery:** AD enumeration using native `net` and `dsquery` commands.
- **Lateral Movement:** Native AD replication and GPO propagation.
- **Collection:** N/A (Focus was on disruption).
- **Exfiltration:** N/A in this specific technical analysis.
- **Impact:** Resource Hijacking and Account Lockout via GPO.
## Impact Assessment
- **Financial:** High (Operational downtime and recovery costs).
- **Data Breach:** Low (Attack was focused on availability/access rather than theft).
- **Operational:** Critical. The entire workforce was locked out of the corporate network simultaneously.
- **Reputational:** Moderate.
## Indicators of Compromise
- **Network indicators:** N/A (Native traffic).
- **File indicators:** N/A (Binary-less).
- **Behavioral indicators:**
- Creation of new GPOs with names like "Update" or "Security Policy."
- Unauthorized modifications to `GptTempl.inf`.
- Scheduled Tasks deployed via GPO to execute `net user` commands.
- Mass login failures across the domain.
## Response Actions
- **Containment:** Disconnecting Domain Controllers from the network to prevent further GPO synchronization.
- **Eradication:** Identification and deletion of the malicious GPOs and associated scripts/tasks in the SYSVOL share.
- **Recovery:** Restoring AD from a clean backup or manually resetting passwords for administrative accounts to regain control.
## Lessons Learned
- **GPO Security:** Group Policy is a powerful, often overlooked attack vector that can bypass standard endpoint security.
- **Monitoring Lacunae:** Traditional EDR may not alert on a GPO change, as it is a "legitimate" administrative action.
- **Binary-less Shift:** Ransomware groups are moving away from detectable binaries toward configuration-based disruption.
## Recommendations
- **Least Privilege:** Strictly limit the number of users in the "Domain Admins" and "Group Policy Creator Owners" groups.
- **GPO Auditing:** Enable advanced auditing for GPO changes (Event IDs 5136-5141) and alert on new GPO creation.
- **Immutable Backups:** Maintain offline or immutable backups of Active Directory state.
- **Two-Factor Authentication (MFA):** Enforce MFA for all administrative access to Domain Controllers and RDP sessions.