ISLAMABAD: A global cyber security company on Tuesday warned Pakistani entities to closely monitor their network administrative tools after a new kind of incident of cyberattack at a manufacturing company operating in the Middle East.
Kaspersky’s Global Emergency Response Team (GERT) has published a new report analyzing a sophisticated new tactic in the Payload ransom ware family.
Discovered during an incident response at a manufacturing company in the Middle East, this attack demonstrates a major shift in cybercrime: the attackers took complete control of the company’s network and forced its computers to lock up, display ransom notes, and change desktop wallpapers — all without deploying a conventional ransomware encryptor.
This incident illustrates one of the trends mentioned in Kaspersky’s State of Ransomware 2026 report released earlier this year: attackers are increasingly moving away from traditional file encryption. Instead, they are adopting “encryptionless extortion” — focusing on immediate operational disruption and leaking sensitive, stolen data on the dark web rather than relying on cryptographic keys to squeeze payments out of victims.
Rather than using complex malware viruses to break into the network, the attackers bypassed initial defenses by acquiring administrator rights. Likely via phishing, they obtained highly privileged user credentials, which they then used to log directly into the corporate network through standard remote-access and VPN entry points.
All of this went undetected, with the attackers appearing to security monitors as legitimate IT staff logging in for routine tasks.
The intruders used the company’s own trusted administrative tools to further execute their attack. They targeted the company’s Active Directory (the backbone of a corporate network) and created a malicious Group Policy Object (GPO) rule.
Kaspersky recommended that the network administrators should closely monitor all GPO creations and modifications.
Security alerts should be configured to trigger the moment a new rule is linked to the root of the corporate network.
Copyright Business Recorder, 2026
Comments