Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

Kaspersky Securelist threat intelligence covering September–August 2026 activity, including ransomware abuse of Active Directory Group Policy, torrent-delivered malware using blockchain-based C2 concealment, APT campaigns targeting Russian, Middle Eastern, African, aviation, financial, and industrial sectors, novel backdoors and rootkits, Android proxy botnets, and vulnerability and exploit trends. The collection highlights enterprise compromise through AD, RDP, GPO, kernel-level concealment, compromised software, and abuse of legitimate cloud, messaging, MQTT, GitHub, and blockchain services.