# Human-Operated Ransomware via GPO Abuse — Domain-Wide Encryption Through Group Policy Weaponization

> Multiple ransomware operators including STORM-0501, CrazyHunter, and LockBit affiliates are actively abusing Active Directory Group Policy Objects (GPOs) to disable Microsoft Defender, deploy ransomware binaries, and execute mass encryption across domain-joined endpoints. Microsoft documented a case study where Predictive Shielding disrupted a GPO-based ransomware attack by detecting GPO manipulation and applying just-in-time hardening before encryption could execute.

- **Published:** 2026-03-23T12:00:00Z
- **Last reviewed:** 2026-03-23T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0273
- **ID:** TL-2026-0273
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** STORM-0501 (Russia)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Human-operated ransomware campaigns are increasingly weaponizing Active Directory Group Policy Objects (GPOs) as a force multiplier for domain-wide impact. This technique leverages the trusted infrastructure of Active Directory to propagate malicious configurations and payloads across all domain-joined endpoints simultaneously, bypassing endpoint-level security controls.

The attack chain typically begins with initial access via compromised credentials or exploitation of public-facing applications, followed by privilege escalation to Domain Admin. Once domain admin privileges are obtained, attackers create or modify GPOs to achieve two critical objectives: (1) disable endpoint security tools — particularly Microsoft Defender real-time protection, alerts, sample submission, and default threat response actions — and (2) deploy ransomware payloads via scheduled tasks that execute with SYSTEM privileges on all domain-joined machines.

Specific GPO modifications target Windows Defender through registry policy paths under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender, setting DisableAntiSpyware, DisableRealtimeMonitoring, and related values. The GPO propagates these settings across the domain during the standard 90-minute Group Policy refresh cycle or immediately when attackers force updates via gpupdate /force.

For ransomware deployment, attackers use tools like SharpGPOAbuse (a .NET C# tool) or direct GPO manipulation to create scheduled tasks that execute ransomware binaries with NT AUTHORITY\SYSTEM privileges. STORM-0501 used a scheduled task named 'SysUpdate' to distribute Embargo ransomware (binaries PostalScanImporter.exe and win.exe). CrazyHunter deployed a Go-based Prince ransomware variant through GPO-pushed scheduled tasks, combined with the ZammoCide tool to kill AV/EDR via the vulnerable Zemana Anti-Malware driver (zam64.sys) using Bring-Your-Own-Vulnerable-Driver (BYOVD) techniques.

The GPO abuse technique is particularly dangerous because it weaponizes trusted AD infrastructure — Group Policy is a legitimate enterprise management mechanism, making malicious GPO modifications harder to detect through traditional endpoint monitoring. The attack bypasses endpoint-level controls entirely by pushing configuration changes from the domain controller.

Microsoft's Predictive Shielding capability, part of the Defender autonomous protection stack, addresses this threat through graph-based prediction logic that combines threat intelligence, past incident patterns, and organizational exposure data. When GPO manipulation is detected as part of an ongoing attack, Predictive Shielding applies GPO hardening — temporarily blocking new GPO policies from being applied to devices identified as high risk — and proactive user containment to restrict compromised credentials. This just-in-time approach disrupts the attack before encryption can execute across the domain.

Multiple ransomware groups have adopted GPO abuse as a standard technique: STORM-0501 (Embargo ransomware, evolving to cloud-based tactics), CrazyHunter (targeting Taiwanese critical infrastructure including hospitals), LockBit affiliates (domain-wide encryption via GPO-deployed scheduled tasks), and various groups deploying Cyclops, Ryuk, and other ransomware families. The technique has been observed in attacks against government, healthcare, education, financial, and manufacturing sectors globally.

## MITRE ATT&CK

- T1484 Domain or Tenant Policy Modification
- T1685 Disable or Modify Tools
- T1053 Scheduled Task/Job
- T1078 Valid Accounts
- T1486 Data Encrypted for Impact
- T1570 Lateral Tool Transfer
- T1021 Remote Services
- T1003 OS Credential Dumping
- T1482 Domain Trust Discovery
- T1069 Permission Groups Discovery
- T1490 Inhibit System Recovery
- T1547 Boot or Logon Autostart Execution
- T1059 Command and Scripting Interpreter
- T1070 Indicator Removal

## Sources

- [Case study: How predictive shielding in Defender stopped GPO-based ransomware before it started](https://www.microsoft.com/en-us/security/blog/2026/03/23/case-study-predictive-shielding-defender-stopped-gpo-based-ransomware-before-started/)
- [Predictive shielding in Microsoft Defender - Microsoft Learn](https://learn.microsoft.com/en-us/defender-xdr/shield-predict-threats)
- [Manage predictive shielding in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/shield-predict-threats-manage)
- [Storm-0501: Ransomware attacks expanding to hybrid cloud environments](https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/)
- [Storm-0501's evolving techniques lead to cloud-based ransomware](https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/)
- [MITRE ATT&CK: Group Policy Modification (T1484.001)](https://attack.mitre.org/techniques/T1484/001/)
- [Sophos: Identifying Group Policy attacks](https://www.sophos.com/en-us/blog/identifying-group-policy-attacks/)
- [CrazyHunter Campaign Targets Taiwanese Critical Sectors - Trend Micro](https://www.trendmicro.com/en_us/research/25/d/crazyhunter-campaign.html)
- [How cyberattackers exploit group policies - Kaspersky Securelist](https://securelist.com/group-policies-in-cyberattacks/115331/)
- [Group Policy Abuse Explained - Semperis](https://www.semperis.com/blog/group-policy-abuse-explained/)
- [SharpGPOAbuse - WithSecure Labs](https://labs.withsecure.com/tools/sharpgpoabuse)
- [Ignite 2025: Microsoft Defender now prevents threats on endpoints during an attack](https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/ignite-2025-microsoft-defender-now-prevents-threats-on-endpoints-during-an-attac/4470805)
- [CrazyHunter Ransomware Tactics, Targets & Mitigation - Cyble](https://cyble.com/threat-actor-profiles/crazyhunter-ransomware-group/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0273