Attackers Disrupted Windows Domains via Group Policy
A 2026 security incident bypassed endpoint defenses by manipulating core infrastructure settings.
Updated on Sept. 21, 2026 in Cybersecurity
Live Poll
Should organizations implement stricter controls over administrative access to prevent unauthorized network disruptions?
In April 2026, unauthorized actors compromised a Windows domain by leveraging stolen credentials to access a FortiGate SSL VPN. Unlike traditional ransomware attacks, this intrusion did not involve malware or file encryption.
Why it matters
The incident demonstrates that attackers can effectively disable corporate infrastructure by weaponizing native administrative tools rather than relying on detectable malware signatures. This strategy highlights the vulnerability of central management systems when boundary defenses are bypassed.
The attackers achieved domain-admin-equivalent rights by gaining control of a FortiGate SSL VPN and subsequently pushing malicious settings via Active Directory Group Policy. This method allowed for system-wide disruption without executing custom code on individual endpoints.
The players
FortiGate
A line of network security appliances providing firewall, VPN, and intrusion prevention capabilities.
Kaspersky GERT
The Global Emergency Response Team providing specialized digital forensics and incident response services.
The details
The intrusion relied on manipulating Active Directory Group Policy, a feature within Windows that allows administrators to define configurations for users and computers across a network. By accessing the domain environment through a compromised FortiGate SSL VPN (a virtual private network service used for secure remote access), the actors were able to propagate disruptive changes globally. This approach intentionally avoided the deployment of encryptors or endpoint-based malware, which are frequently caught by signature-based detection systems.
Timeline
April 2026: Unauthorized actors gained access to a FortiGate SSL VPN.
April 13, 2026: The Kaspersky Global Emergency Response Team (GERT) initiated a response to the incident.
The Tech Race
This event underscores a shift toward 'living-off-the-land' tactics that bypass security tools designed for traditional malware prevention. It mirrors the precedent set by the 2021 Kaseya supply chain attack, where administrative remote management software was exploited to compromise enterprise infrastructure.
Organizations should treat VPN credentials with the same security priority as domain administrative accounts to prevent unauthorized infrastructure control. Administrators must monitor Active Directory Group Policy modifications for unexpected changes to maintain domain integrity.
The takeaway
The event highlights that administrative software is a high-value target that requires robust, multi-factor authentication for all remote access points. Security teams should prioritize monitoring configuration changes in Active Directory to detect future unauthorized policy modifications.
Further reading
For broader trends in infrastructure defense, explore the latest analysis in Cybersecurity.
Live Poll
Should organizations implement stricter controls over administrative access to prevent unauthorized network disruptions?
