Loading malware…
Mamona is a ransomware family associated with the same criminal ecosystem behind BlackLock and later Global Group, and appears to have been used as an intermediate rebrand in that lineage during 2025. Reporting links Mamona to the operator alias "$$$" and to ransomware-as-a-service activity advertised on Russian-language criminal forums. Operational overlaps with Global include shared infrastructure patterns and reuse of the same mutex value, indicating close code or operator continuity rather than a merely nominal relationship.
Mamona targets enterprise environments and is tied to extortion operations that combine data theft with file encryption. Its successor lineage demonstrates capabilities including deletion of shadow copies, anti-analysis measures, multithreaded encryption, custom ransom-note deployment, and pressure tactics centered on leaking stolen data. Campaigns associated with the Mamona-to-Global transition have used phishing-delivered malware chains in which deceptive Windows shortcut attachments and living-off-the-land execution led to ransomware deployment. Mamona has also been discussed in connection with BlackLock affiliates, Embargo-linked activity, and later intersections with DragonForce-related operations, reflecting the fluid affiliate and rebranding dynamics common in the contemporary ransomware ecosystem.
Mamona is best understood as a short-lived ransomware brand within a broader financially motivated RaaS cluster that evolved from BlackLock and was subsequently rebranded as Global Group. Victimology associated with that cluster includes healthcare and manufacturing organizations, though Mamona itself is primarily notable for its role in that lineage rather than for uniquely documented technical distinctions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
March 11, 2025 - the actor "$$$" behind BlackLock Ransomware announced the launch of a new project called Mamona Ransomware.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware strain launched in 2025 and rapidly rebranded as Global ransomware.
Ransomware family referenced in related reading; no additional technical behavior described in the provided content beyond mention of offline encryption in the title.
Referenced as the predecessor ransomware family to Global Group.
Referenced as the predecessor ransomware family to Global Group.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.