Microsoft Drops SMS Sign-In, PAYLOAD Ransomware Hijacks Group Policy, and a Signed Driver Disables 1

by The Creator | Sep 21, 2026

A ransomware attack response requires immediate action on four fronts: secure your VPN and enforce multi-factor authentication to block initial access, audit Active Directory Group Policy Objects for unauthorized changes, verify backup systems are working (Microsoft's recent File History bug may have disabled yours), and restrict driver installations to prevent attackers from disabling your security tools.

Microsoft Drops SMS Sign-In, PAYLOAD Ransomware Hijacks Group Policy, and a Signed Driver Disables 145 Security Tools

In today's cybersecurity update for September 21, 2026, small business owners face several critical developments:

Microsoft is retiring SMS-based first-factor sign-in for Entra ID (formerly Azure Active Directory) on February 1, 2027. Businesses using Microsoft 365 must migrate affected users to phishing-resistant authentication methods like authenticator apps or passkeys to avoid sign-in disruptions. SMS one-time passcodes are vulnerable to interception.

Microsoft's September 2026 security updates have broken the Windows File History backup feature on some systems, preventing the creation or updating of backups. Users may incorrectly assume their files are protected. Microsoft is investigating the issue, and businesses should verify their backup status manually and consider alternative backup methods until resolved.

A sophisticated supply-chain attack involving ten malicious npm packages, including indexed-btree (which impersonated the legitimate sorted-btree library), has affected nearly two million downloads. The malware executes only at application runtime, bypassing traditional security scans. Businesses with development teams should audit installed npm packages immediately, as the malicious code can steal data and provide attackers with system access.

The PAYLOAD ransomware group has demonstrated a new attack method that disrupts operations without traditional file encryption. Attackers gained access through a compromised FortiGate SSL VPN using stolen domain credentials, escalated to domain-admin rights, then used Active Directory Group Policy Objects to display ransom demands, disable security defenses, and lock administrator access across the entire Windows domain. This highlights the critical need to protect VPN access points, enforce multi-factor authentication, limit domain admin privileges, and monitor for unauthorized Group Policy modifications (CVE references and technical version numbers available in source articles).

A new information-stealing campaign called Rapuncel exploits a Microsoft-attested kernel driver to disable up to 145 antivirus and endpoint detection and response tools before stealing browser credentials, cryptocurrency wallet data, chat tokens, and Windows credentials. The signed driver is trusted by Windows, allowing the malware to terminate security processes. The campaign spread through fake GitHub pages impersonating LastPass Authenticator. Businesses should enforce policies requiring software downloads only from official sources and implement application control rules to restrict driver installations.

How does ransomware attack response differ when attackers use Group Policy?

The PAYLOAD ransomware group bypassed traditional encryption entirely by hijacking Active Directory Group Policy Objects to lock out administrators and disable security controls across your entire Windows domain. This attack method spreads faster and causes immediate operational shutdown without waiting for file encryption. SMB response: immediately check Event Viewer for unauthorized Group Policy modifications, isolate affected domain controllers, reset compromised admin credentials, and enforce multi-factor authentication on all VPN access points. CISA warns that stolen FortiGate VPN credentials remain the primary entry vector. Your single most important action is verifying VPN logs for unauthorized access within the last 30 days.

Key takeaways

Verify your Windows File History backups are actually running (Microsoft's September 2026 updates broke this feature on some systems).
Restrict driver installations and block unsigned drivers using Group Policy to prevent malware from disabling antivirus tools.
Enforce multi-factor authentication on all VPN accounts and limit domain-admin privileges to prevent lateral movement.
Audit npm packages if you have development teams (two million downloads of malicious packages were distributed in September 2026).

Frequently asked questions

What should I do if I find unauthorized changes to my Group Policy?

Take your domain controllers offline immediately and contact your IT provider or CISA. Restore Group Policy from a known-good backup and reset all domain admin credentials. Check for VPN access logs from the past 30 days to identify the entry point.

How do I verify my Windows backups are actually working?

Open File History settings and confirm the backup date is recent (not from weeks ago). Microsoft's September 2026 updates broke File History on some systems, so manually test a backup restoration on a non-critical file. Consider switching to third-party backup tools until Microsoft resolves the issue.

What is a signed driver attack and why should I care?

Attackers can use Windows-trusted drivers to disable your antivirus and endpoint detection tools before stealing credentials. Prevent this by blocking unsigned driver installations and restricting administrator-level driver access through Group Policy and application control rules.

Should I migrate from SMS authentication before February 2027?

Yes. SMS-based sign-in is vulnerable to interception and Microsoft is retiring it for Entra ID on February 1, 2027. Migrate to authenticator apps or passkeys now to avoid sign-in disruptions when the deadline arrives.