Threat Hunter: 2026-09-22

1. Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

   Kaspersky Securelist, 2026-09-21. Leer, 26 min.

   Kaspersky’s Global Emergency Response Team describes an April 2026 incident at a Middle East manufacturer where an actor with domain admin-equivalent control created a Group Policy Object named PAYLOAD, linked it at the domain root, and used it to push ransom notes and disable the local administrator account on every domain-joined Windows workstation, without dropping a ransomware binary or encrypting any data. The only ransomware sample found targeted ESXi on Linux servers, and Kaspersky assesses with moderate confidence the missing Windows encryption was either deliberate or interrupted.

   Por qué importa para este rol: You go looking for what alerts miss, and a GPO-delivered attack leaves no binary or process to find, so hunt directory-service changes such as gPLink edits at the domain root by non-standard accounts.

2. TerminalFix: PNG Steganography

   SANS Internet Storm Center, 2026-09-21. Leer, 4 min.

   Didier Stevens, writing for the SANS Internet Storm Center, analyzed the PNG files from the TerminalFix campaign that Microsoft Security Research described and found they are valid PNG images with no appended data or metadata, so the payload hides in the pixel data itself. The first image carries a genuine Microsoft executable, LockScreenContentServer.exe, used for sideloading, and two further images hold a malicious DLL split in two parts, with the actors using all of the available bits so the original image is lost when rendered.

   Por qué importa para este rol: Hunting for staged payloads means examining images, and this shows a valid PNG can carry a full executable in its pixel data, so add pixel-level checks rather than trust a clean file structure.

Threat Hunter