# The wallpaper was the ransom

2026-09-22

Kaspersky’s GERT found a PAYLOAD incident that locked a manufacturing network with Group Policy. No Windows encryptor. The data still went to a leak site.

Canonical: https://www.fabiocti.com/notes/the-wallpaper-was-the-ransom/
Author: Fabio Correia

Helpdesk will look for a ransomware binary. There is not one.

Kaspersky’s Global Emergency Response Team published yesterday on an unnamed manufacturer in the Middle East. Attackers used a compromised domain account through the FortiGate SSL VPN on 11 April, had domain-admin equivalent rights by the 13th, and linked a Group Policy Object named `PAYLOAD` at the root of the domain. `README-payload.txt` on the desktop. `payload.jpg` as wallpaper and lock screen. Local administrator disabled. A second GPO, `win Firewall Off`. Endpoints got the policy on the 13th. People rebooted on the 14th and the building stopped.

Forensics found no malicious Windows executable and no encryptor on those workstations. Kaspersky did find a PAYLOAD variant aimed at ESXi. The Windows pain was policy. The stolen file-server data still went to a leak site.

## What “encryptionless” does not mean

It does not mean there was no incident. It means the restoration playbook that starts with “do we have the decryptor” is the wrong document. There is nothing to decrypt. There is a GPO that will put the wallpaper back the next time a machine talks to the domain.

EDR that watches for `*.exe` named like ransomware will file this as a wallpaper ticket. The domain controller is the payload. Cleaning laptops first, while the GPO is still linked, is how you relock the floor after lunch.

## What to pull if the lock screen is the note

Export the GPOs before anyone “fixes” them. Who created `PAYLOAD`, when it was linked, what is in SYSVOL. VPN logs for the domain account on 11 April, not the helpdesk queue on 14 April. Assume the dump is already a separate question: listing, object, is it yours. Same pass as any other leak site. The missing encryptor does not make the archive smaller.

If your IR firm is hunting a binary on the CEO laptop, they are in the wrong forest. The ransom note was a Group Policy. The leak is the rest of the job.