Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Kaspersky Securelist reporting from August–September 2026 covers ransomware abuse of Active Directory Group Policy, torrent-delivered multi-stage malware using Solana for C2 concealment, APT campaigns targeting Russian, Middle Eastern, African, aviation, and financial organizations, MQTT/Element-based backdoors, adware masquerading, industrial control system threats, Android proxy botnets, and a kernel-level Windows rootkit. The collection highlights active exploitation of enterprise infrastructure, covert command-and-control, persistence, defense evasion, and malware delivery through trusted-