Detection Engineer: 2026-09-22

1. Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

   Kaspersky Securelist, 2026-09-21. Read, 26 min.

   Kaspersky’s Global Emergency Response Team describes an April 2026 incident at a Middle East manufacturer where an actor with domain admin-equivalent control created a Group Policy Object named PAYLOAD, linked it at the domain root, and used it to push ransom notes and disable the local administrator account on every domain-joined Windows workstation, without dropping a ransomware binary or encrypting any data. The only ransomware sample found targeted ESXi on Linux servers, and Kaspersky assesses with moderate confidence the missing Windows encryption was either deliberate or interrupted.

   Why it matters for this role: You write the rules that turn logs into alerts, and this incident hands you a concrete one: alert on event 5136 for gPLink changes at the domain root, which catches an attack that drops no binary to detect.

Detection Engineer