{
  "slug": "payload",
  "group": "payload",
  "name": "payload",
  "note": null,
  "attck": [],
  "activity": {
    "postings": 18,
    "first": "2026-08-11",
    "last": "2026-11-03",
    "countries": {
      "DE": 9,
      "??": 3,
      "FR": 1,
      "CH": 4,
      "JO": 1
    },
    "sectors": {
      "manufacturing": 7,
      "consumer": 3,
      "education": 1,
      "government": 1,
      "services": 2,
      "unknown": 1,
      "technology": 2,
      "finance": 1
    },
    "recent": [
      {
        "date": "2026-11-03",
        "name": "Stahlbau Mann GmbH",
        "country": "DE",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/U3RhaGxiYXUgTWFubiBHbWJIQHBheWxvYWQ"
      },
      {
        "date": "2026-10-31",
        "name": "Straze Garden Center",
        "country": "??",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/U3RyYXplIEdhcmRlbiBDZW50ZXJAcGF5bG9hZA"
      },
      {
        "date": "2026-10-31",
        "name": "Kraft Lernen",
        "country": "DE",
        "sectors": [
          "education"
        ],
        "url": "https://www.ransomware.live/id/S3JhZnQgTGVybmVuQHBheWxvYWQ"
      },
      {
        "date": "2026-10-31",
        "name": "SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH)",
        "country": "DE",
        "sectors": [
          "government"
        ],
        "url": "https://www.ransomware.live/id/U0FMRUcgKFNhY2hzZW4tQW5oYWx0aXNjaGUgTGFuZGVzZW50d2lja2x1bmdzZ2VzZWxsc2NoYWZ0IG1iSClAcGF5bG9hZA"
      },
      {
        "date": "2026-10-28",
        "name": "Hauhinco",
        "country": "DE",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/SGF1aGluY29AcGF5bG9hZA"
      },
      {
        "date": "2026-10-28",
        "name": "Marbre Design",
        "country": "FR",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/TWFyYnJlIERlc2lnbkBwYXlsb2Fk"
      },
      {
        "date": "2026-10-26",
        "name": "Glückauf-Vermessung GmbH",
        "country": "DE",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/R2zDvGNrYXVmLVZlcm1lc3N1bmcgR21iSEBwYXlsb2Fk"
      },
      {
        "date": "2026-10-26",
        "name": "Miletic GmbH",
        "country": "DE",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/TWlsZXRpYyBHbWJIQHBheWxvYWQ"
      },
      {
        "date": "2026-10-26",
        "name": "Edelstahl-Mechanik GmbH",
        "country": "DE",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/RWRlbHN0YWhsLU1lY2hhbmlrIEdtYkhAcGF5bG9hZA"
      },
      {
        "date": "2026-10-20",
        "name": "BW Office World",
        "country": "??",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/QlcgT2ZmaWNlIFdvcmxkQHBheWxvYWQ"
      },
      {
        "date": "2026-10-20",
        "name": "Brüninghoff Group",
        "country": "DE",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/QnLDvG5pbmdob2ZmIEdyb3VwQHBheWxvYWQ"
      },
      {
        "date": "2026-10-08",
        "name": "Boullard Musique",
        "country": "CH",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/Qm91bGxhcmQgTXVzaXF1ZUBwYXlsb2Fk"
      }
    ]
  },
  "convergences": [],
  "reports": [
    {
      "url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/",
      "publisher": "Kaspersky Securelist",
      "published": "2026-09-21",
      "title": "Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO",
      "origin": "feed",
      "primary": true
    }
  ],
  "techniques": [
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactics": [
        "collection"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 0
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactics": [
        "privilege-escalation"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 30,
      "related": 0
    },
    {
      "id": "T1070.001",
      "name": "T1070.001",
      "tactics": [],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 20
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 7,
      "related": 59
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 55,
      "related": 54
    },
    {
      "id": "T1078.002",
      "name": "Domain Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 5,
      "related": 55
    },
    {
      "id": "T1133",
      "name": "External Remote Services",
      "tactics": [
        "persistence",
        "initial-access"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 0
    },
    {
      "id": "T1484.001",
      "name": "Group Policy Modification",
      "tactics": [
        "defense-impairment",
        "privilege-escalation"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 6,
      "related": 1
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactics": [
        "impact"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 0
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactics": [
        "impact"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 27,
      "related": 0
    },
    {
      "id": "T1491.001",
      "name": "Internal Defacement",
      "tactics": [
        "impact"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 4,
      "related": 0
    },
    {
      "id": "T1531",
      "name": "Account Access Removal",
      "tactics": [
        "impact"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 9,
      "related": 0
    },
    {
      "id": "T1562.001",
      "name": "T1562.001",
      "tactics": [],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1562.004",
      "name": "T1562.004",
      "tactics": [],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1685",
      "name": "Disable or Modify Tools",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 162,
      "related": 44
    },
    {
      "id": "T1685.005",
      "name": "Clear Windows Event Logs",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 162
    },
    {
      "id": "T1686",
      "name": "Disable or Modify System Firewall",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 7,
      "related": 27
    }
  ],
  "cves": [],
  "indicators": {
    "list": [
      {
        "type": "ipv4",
        "value": "104.164.55.46",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "104.28.162.228",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "104.28.163.162",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "146.70.117.239",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "149.102.229.154",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "192.42.116.12",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "192.42.116.50",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "192.42.116.52",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "192.42.116.56",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "192.42.116.97",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "37.19.210.12",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      },
      {
        "type": "ipv4",
        "value": "64.190.76.14",
        "source": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/"
      }
    ],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 17,
    "defendable": 17,
    "covered": 14,
    "uncovered": [
      "T1070.001",
      "T1562.001",
      "T1562.004"
    ]
  }
}