Incident Responder: 2026-09-22

1. Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

   Kaspersky Securelist, 2026-09-21. Read, 26 min.

   Kaspersky’s Global Emergency Response Team describes an April 2026 incident at a Middle East manufacturer where an actor with domain admin-equivalent control created a Group Policy Object named PAYLOAD, linked it at the domain root, and used it to push ransom notes and disable the local administrator account on every domain-joined Windows workstation, without dropping a ransomware binary or encrypting any data. The only ransomware sample found targeted ESXi on Linux servers, and Kaspersky assesses with moderate confidence the missing Windows encryption was either deliberate or interrupted.

   Why it matters for this role: If you are called to an Active Directory compromise, this case shows impact can be delivered entirely through a malicious GPO with no ransomware binary, so containment has to reach Group Policy and the domain root.

2. TerminalFix: PNG Steganography

   SANS Internet Storm Center, 2026-09-21. Read, 4 min.

   Didier Stevens, writing for the SANS Internet Storm Center, analyzed the PNG files from the TerminalFix campaign that Microsoft Security Research described and found they are valid PNG images with no appended data or metadata, so the payload hides in the pixel data itself. The first image carries a genuine Microsoft executable, LockScreenContentServer.exe, used for sideloading, and two further images hold a malicious DLL split in two parts, with the actors using all of the available bits so the original image is lost when rendered.

   Why it matters for this role: When your investigation turns up planted PNG files, this analysis shows the malicious code can live in the pixels themselves, so you cannot clear an image just because it has no appended data or metadata.

Incident Responder