Loading story…
A PAYLOAD ransomware affiliate compromised a Middle Eastern manufacturing organization in April 2026 using a valid domain credential through a FortiGate SSL VPN. After obtaining domain-admin-equivalent Group Policy permissions, the actor linked malicious GPOs at the Active Directory domain root to distribute ransom notes, alter endpoint wallpapers and lock screens, set a ransom logon banner, disable local Administrator accounts, and disable Windows Firewall. Investigators found no encrypted Windows files, persistent endpoint malware, or active malicious processes; Active Directory and SYSVOL served as the attack control plane. The attackers exfiltrated data from file servers and other systems, later publishing it on the dark web, while an ESXi-targeting PAYLOAD sample was identified on Linux servers.
The intrusion reflects the growth of encryptionless extortion, in which operators steal data and coerce victims without necessarily deploying file-encrypting malware. Extortion activity reached 6,182 reported incidents in 2025, while ransomware leak sites claimed 4,737 victims; attackers commonly combine stolen credentials, privilege escalation, legitimate administrative tooling, and centralized deployment mechanisms such as Group Policy. Organizations should prioritize MFA and monitoring for remote access, least-privilege controls over GPO administration, auditing of domain-root GPO changes and SYSVOL, rapid credential containment, and defenses against data exfiltration alongside endpoint ransomware controls.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
Incident responders confirmed that affected Windows endpoints had not undergone file encryption and contained no resident endpoint malware. They found the Active Directory GPO link, rather than an endpoint-resident component, served as the persistence mechanism.
Kaspersky's Global Emergency Response Team began responding to the PAYLOAD incident at the affected manufacturer.
As endpoints rebooted or refreshed policy, the malicious GPO settings applied, displaying PAYLOAD ransom imagery and notes and causing operational disruption. The policies had been cached on endpoints the previous day.
The actor exfiltrated data from the manufacturer's file servers and several additional systems. The stolen data was subsequently published on the dark web.
The actor created and linked the PAYLOAD GPO and a separate "win Firewall Off" GPO at the Active Directory domain root. The policies distributed ransom notes and imagery through SYSVOL, disabled local Administrator accounts, and disabled Windows Firewall across profiles.
The PAYLOAD ransomware operation authenticated to a Middle Eastern manufacturing victim's FortiGate SSL VPN using a valid compromised domain credential. Investigators could not reconstruct how the credential was initially compromised because of insufficient FortiGate logging.
A Snakefly (Cl0p) campaign targeting Oracle E-Business Suite users came to light. The group exploited CVE-2025-61882, a critical vulnerability allowing unauthenticated remote code execution on vulnerable EBS systems.
The RansomHub ransomware-as-a-service operation, also known as Greenbottle, shut down.
Leak-site data recorded 4,737 ransomware claims during 2025, compared with 4,701 in 2024. Including encryptionless cases, total extortion attacks reached 6,182, a 23% increase over 2024.
LockBit (also known as Syrphid) collapsed or was significantly disrupted and did not successfully rebuild despite later attempts.
Investigators identified an ESXi-targeting PAYLOAD ransomware sample on Linux servers in the victim environment, although the investigation did not establish that it was used to encrypt systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securelist.ru
Open sourcesecurelist.com
Open sourcemicrosoft.com
Open sourcesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Payload** is a newly observed ransomware strain targeting Windows environments and rapidly expanding its operations, with about 50 victims listed on its leak site by late March. The malware appends the `.payload` extension to encrypted files and drops a ransom note named `RECOVER_payload.txt`, while focusing on sectors where downtime can quickly drive extortion pressure, including logistics, transportation, construction, real estate, manufacturing, and technology. Technical analysis indicates Payload uses a mature cryptographic design built on per-file **Curve25519 ECDH** key exchange and **ChaCha20** encryption, making recovery without the operators’ private key effectively infeasible. The ransomware also uses aggressive anti-forensics and disruption tactics before encryption, including deleting shadow copies, clearing Windows Event Logs, patching ETW-related functions in `ntdll`, terminating processes, and stopping backup and database services. Separate reporting on **Vect** highlighted a contrasting trend in the ransomware ecosystem: although Vect marketed enterprise-focused cross-platform ransomware for Windows, Linux, and ESXi, researchers found a critical cryptographic flaw that irreversibly destroys files larger than 128 KB, effectively turning many attacks into data wiping events even if victims pay. Together, the findings show a split between technically competent operators such as Payload and poorly engineered ransomware like Vect that can still cause severe business disruption.
Jun 29, 2026
Play/PlayCrypt ransomware operators have used a repeatable double-extortion workflow beginning with compromised administrator credentials and RDP access. In two examined intrusions, the actors manually identified valuable data, archived it with WinRAR using the distinctive `-ep1 -scul -r0` options, and exfiltrated it through WinSCP. One operation was disrupted before encryption but continued data theft after defenders disabled an account; another reached encryption on more than 15 systems within roughly six hours, using PsExec to deploy distinct ransomware payloads from `C:\Users\Public\Music\`, disabling Windows protections, and deleting shadow copies. The group, active since 2022 and responsible for roughly 900 known victim entities as of May 2025, also gains entry through exposed applications, including FortiOS, Microsoft Exchange ProxyNotShell, and activity associated with SimpleHelp `CVE-2024-57727`. Its tooling includes Grixba for domain-wide discovery and inventory of security, backup, and remote-management products, plus a custom VSS utility that copies locked files from shadow snapshots before encryption. Defenders should prioritize MFA and rapid remediation of internet-facing vulnerabilities, while monitoring for the WinRAR command-line pattern, WinSCP transfers, Defender exclusions, random service creation, PsExec activity, and executable writes under the Public Music directory; offline immutable backups and network segmentation remain essential to limit impact.
Sep 20, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026