Green Blood Group
Green Blood Group is a ransomware gang / ransomware operation. In the provided reporting, it claimed responsibility for a cyberattack against Senegal’s Directorate of File Automation (DAF), an agency that manages national ID cards, passports, biometric records, and other sensitive national identity data. The attack reportedly temporarily suspended DAF operations. Green Blood Group claimed it stole 139 GB of data from DAF systems; claimed stolen data included citizen database records, immigration files, and biometric details; and leaked an email allegedly showing exfiltration of card personalization data after two DAF servers were breached. The content only directly supports the alias Green Blood Group and does not provide high-confidence attribution to a nation-state or identify sub-groups.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇸🇳 Senegal
Tradecraft
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Claimed a breach of Senegal’s digital ID system and exfiltration of a large volume of sensitive data, including biometric data.
Ransomware operation claiming data theft (139 GB) from Senegal's Directorate of File Automation, with alleged exfiltration of citizen database records, immigration files, and biometric details; also referenced leaking an email related to the incident.
Claimed a ransomware-related intrusion and data theft (139 GB) against Senegal’s Directorate of File Automation, impacting national ID/passport/biometric record management operations.
Claimed a ransomware-related intrusion and data theft (139 GB) against Senegal’s Directorate of File Automation, impacting national ID/passport/biometric record management operations.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.