Global Group

Global Group is a ransomware family and ransomware-as-a-service (RaaS) operation that emerged in 2025 and is described in the provided reporting as a successor to the Mamona ransomware family; some reporting also suggests it may be linked to or a possible rebrand of BlackLock/Black Lock. It has been delivered in phishing campaigns associated with the Phorpiex botnet, including high-volume malspam using subjects such as "Your Document" and ZIP attachments containing double-extension Windows shortcut files such as "Document.doc.lnk." When executed, the LNK launches cmd.exe and PowerShell to download and run the ransomware payload, sometimes under names resembling legitimate Windows files such as "windrv.exe," using living-off-the-land techniques to reduce detection.

A notable capability is its offline or "mute" mode: Global Group generates encryption keys locally on the victim host and does not require command-and-control communication to begin encryption, making it viable in offline and air-gapped environments and reducing opportunities for network-based detection. The malware is reported to use ChaCha20-Poly1305 for encryption, append the ".Reco" extension to encrypted files, delete Volume Shadow Copies, terminate analysis and database-related processes to maximize encryption impact, delay briefly using a ping to 127.0.0.7, and then self-delete to reduce forensic artifacts. Reporting in the provided content also states that it changes the victim wallpaper to display a ransom note. One source explicitly notes that this strain conducts no data exfiltration and performs activity locally on the compromised system.

Operationally, Global Group is described as a RaaS operation with a Tor-based negotiation portal. Reporting states that victims are directed from the ransom note to this portal, where an AI chatbot interacts with victims, automates communications, and applies psychological pressure during negotiations. Reviewed chat transcripts reportedly showed demands reaching seven-figure sums, including 9.5 BTC in one case. The group has been mentioned alongside other 2025 ransomware brands and was reported claiming a breach of Albavisión involving alleged theft of 400GB of data. High-confidence infection-chain indicators and behaviors mentioned in the content include phishing emails with LNK attachments disguised as documents, use of cmd.exe and PowerShell, payload names such as windrv.exe, local key generation, ChaCha20-Poly1305 encryption, deletion of shadow copies, self-deletion after a ping-based delay, process termination, the ".Reco" file extension, and use of a Tor negotiation portal with an AI chatbot.