Green Blood Group

Green Blood Group is a ransomware and data-extortion threat actor active since at least early 2026 and associated with the GreenBlood ransomware family. The group has publicly identified itself as “TH3 GR33N BL00D GROUP.” Its malware encrypts victim files and demands payment for decryption, using a combination of symmetric and asymmetric encryption. Reported victimology indicates targeting of English-speaking users with potentially broader global reach. The actor has been linked to an intrusion affecting Senegal’s Directorate of File Automation, a government entity responsible for national identity services including ID cards, passports, and biometric records. In that incident, Green Blood Group claimed to have stolen a large volume of sensitive data and publicly asserted access to citizen, immigration, and biometric information, indicating both disruptive and theft-based objectives. Observed tradecraft supports ransomware and extortion operations centered on file encryption and data exfiltration. Reported initial access vectors include insecure remote access exposure, phishing and malicious attachments, deceptive downloads, exploit-driven compromise, malvertising, botnet-facilitated delivery, fake updates, and trojanized installers, although not every vector is confirmed in a specific intrusion. The actor’s operations therefore align with financially motivated ransomware activity combining intrusion, encryption, and theft of sensitive data for leverage.