Loading malware…
Global, also referred to as GLOBAL GROUP, is a ransomware family/group publicly introduced on Ramp4u in June 2025 and tied in reporting to earlier brands Mamona and BlackLock. Reporting describes it as a cross-platform ransomware operation with support for Windows, Linux, and VMware ESXi. One cited early sample is associated with the mutex string "Global\Fxo16jmdgujs437". In January 2026, a ransomware strain resembling the Global family was reportedly deployed via Phorpiex against devices in China, using a public IP-lookup API to verify the target’s location before dropping the payload; a follow-on campaign reportedly expanded to 21 countries including the United States, United Kingdom, Germany, and France. The provided content does not include additional high-confidence details on encryption behavior, ransom note naming, or specific victim sectors for Global itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family referenced as a payload deployed via Phorpiex, including targeting in China and a later campaign spanning 21 countries.
Cross-platform ransomware operation targeting Windows/Linux/ESXi; extensions may be affiliate-defined/variable; linked to prior branding (Mamona/BlackLock).
Cross-platform ransomware operation/brand (Windows/Linux/ESXi) introduced as “GLOBAL GROUP”, with reporting tying it to earlier brands (Mamona/BlackLock).
Ransomware operation referenced as contributing persistent activity in Q2 2025 (no additional detail provided).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.