MaaS Platform Leverages GitHub and Active Directory to Spread PAYLOAD Ransomware

Key points

• A subscription-based malicious toolset called ChainScript is being used to distribute PAYLOAD ransomware.
• Attackers misuse GitHub and Node.js to compile newsletters that deliver malware.
• Group Policy Objects are hijacked to weaponize Active Directory across victim networks.
• Approximately forty organizations have been impacted, with remote access trojans installed.
• No CVE is associated; the threat relies on configuration abuse and social engineering.

A malware-as-a-service (MaaS) platform has been observed leveraging a tool called ChainScript to compromise enterprise networks. The operation abuses legitimate services like GitHub and Node.js to compile and distribute malicious newsletters, which then deliver the PAYLOAD ransomware and remote access trojans (RATs). Approximately forty companies have been affected so far. No specific CVE is tied to this campaign; instead, it exploits misconfigurations and trusted platforms.

The attack chain begins with newsletter compilation, likely using Node.js scripts hosted on GitHub. Once inside, the actors hijack Group Policy Objects (GPOs) to push malicious settings across Active Directory environments. This allows them to weaponize Active Directory, turning it into a distribution mechanism for ransomware and RATs. The use of GitHub for hosting malicious code and Microsoft's Active Directory as a propagation vector makes detection challenging.

While the reported victims are businesses, the techniques pose a direct risk to K-12 school districts and government agencies. Many educational institutions rely on Active Directory and Group Policy for managing thousands of student and staff accounts. A similar intrusion could disrupt learning, expose sensitive data, and lead to costly recovery. The MaaS model lowers the barrier to entry, meaning even less sophisticated actors can launch such attacks.

Why it matters: This campaign highlights the convergence of ransomware, RATs, and living-off-the-land techniques. By abusing legitimate tools like GitHub and Node.js, attackers evade traditional signature-based defenses. The absence of CVEs means patching alone won't stop it; organizations must harden configurations and monitor for anomalous GPO changes. The scale of forty companies suggests a coordinated, ongoing effort.

What to watch: IT teams should monitor for unexpected GitHub repositories referencing your organization, unusual Node.js processes, and unauthorized modifications to Group Policy. Microsoft and GitHub may release guidance or takedowns. Given the severity, we rate this threat as high. Proactive auditing of Active Directory permissions and GPO links is critical.

What to do now

1. Audit and restrict Group Policy Object (GPO) creation and modification permissions to only essential administrative accounts.
2. Monitor GitHub and other code repositories for references to your organization or suspicious Node.js scripts; block unauthorized outbound connections to paste sites and code-sharing platforms.
3. Enable advanced auditing for Active Directory changes, especially GPO modifications, and alert on unexpected alterations.
4. Deploy endpoint detection and response (EDR) to catch RAT and ransomware behaviors, focusing on process injection and persistence mechanisms.
5. Conduct a review of newsletter compilation and distribution processes; ensure no unsanctioned scripts or third-party services are used.
6. Implement network segmentation to limit lateral movement from compromised workstations to domain controllers.
7. Train staff to recognize phishing and malicious newsletters that may deliver ChainScript or PAYLOAD ransomware.

Original source

Security Affairs