Loading story…
Cofense reported that the financially motivated Global Group ransomware-as-a-service operation is using payment-plan-themed phishing emails to compromise organizations. Victims receive a PDF that leads to a malicious download site hosting an ISO image containing an executable and LNK shortcut; execution abuses the legitimate WinMerge.exe process to retrieve the ransomware encryptor from attacker-controlled infrastructure.
Global Group is assessed as a rebrand of the Black Lock and Mamona ransomware families, reusing backend infrastructure and code artifacts while targeting large enterprises across industries. The operation uses initial-access brokers for pre-compromised corporate credentials and employs double extortion: its encryptor disables security processes, searches local drives, network shares, and databases, encrypts data with the .nZASJgT extension, and threatens public release of stolen data.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Cofense Phishing Defense Center published an analysis of a phishing-led ransomware campaign attributed to Global Group, assessing the RaaS operation to be a rebrand of the Black Lock and Mamona ransomware families. The analysis reported that the group retained related backend infrastructure and code artifacts and targeted large enterprises through phishing and double extortion.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Forcepoint X-Labs reported a high-volume phishing campaign leveraging the long-running **Phorpiex** botnet to deliver **Global Group ransomware** (described as a successor to the **Mamona** family). The emails commonly use the subject line **“Your Document”** and include attachments that appear to be documents inside ZIP archives but are actually malicious Windows Shortcut files (`.lnk`) disguised via double extensions such as `Document.doc.lnk`—a tactic that benefits from Windows hiding file extensions by default. When opened, the shortcut triggers a *living-off-the-land* execution chain (e.g., `cmd.exe` and PowerShell) to download and run a secondary payload that may be named to resemble a legitimate component (e.g., `windrv.exe`). Reporting highlighted that Global Group ransomware can operate in a **“mute” mode**, enabling offline encryption behavior intended to reduce reliance on command-and-control and evade some traditional detections. Separate coverage about the purported **0APT** leak site and a Coveware/Clop-focused analysis of downstream mass data-extortion payment trends are not part of this Phorpiex/Global Group activity and do not add incident-specific details to the LNK-based ransomware delivery campaign.
Jun 29, 2026
A new ransomware group known as **Gentlemen** has launched a series of attacks targeting organizations in at least 17 countries, employing a double extortion model that involves both data exfiltration and encryption. The ransomware, developed in the Go programming language, leverages advanced techniques such as Group Policy Object (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD) tactics to disable security defenses and propagate laterally within corporate networks. Industries affected include healthcare, manufacturing, and insurance, with the group specifically focusing on medium to large enterprises. The malware requires a specific `--password` argument to execute, serving as an anti-analysis measure, and offers operators various command-line options to control its behavior and evade detection. Analysts have identified Gentlemen as one of the most active emerging ransomware threats of 2025, with rapid expansion across North America, South America, and the Middle East. The group’s sophisticated evasion and propagation methods, combined with its aggressive targeting of sensitive data, underscore the urgent need for enhanced monitoring and defensive measures in enterprise environments. The campaign’s use of double extortion ensures that even organizations with robust backup strategies remain vulnerable to data leaks and reputational damage if ransoms are not paid.
Jun 29, 2026
GuidePoint Security's GRIT reported that an entity calling itself **"Ransom Busters"** contacted ransomware victims with unsolicited offers to recover encrypted files and delete stolen data, claiming it had access to ransomware groups' infrastructure and encryption keys. Investigators assessed with moderate confidence that the operation was not a legitimate incident-recovery service but a ransomware affiliate conducting secondary extortion across multiple ransomware-as-a-service ecosystems, including intrusions linked to **DragonForce**, **Settra**, and **Anubis**. In several cases, the outreach arrived before the incidents were publicly disclosed, raising concerns that the sender had direct knowledge of the attacks. GRIT tied the activity together through overlapping tooling and infrastructure, including **SoftPerfect Network Scanner**, **s5cmd**, **Remotely**, a reused local backdoor password, and a shared attacker-controlled hostname. The actor reportedly demanded **$20,000 to $60,000** and pushed for **Bitcoin** payment while using a privacy-focused email service and early pricing demands as part of the scheme. Researchers said the campaign appears designed to divert ransom negotiations and let an affiliate monetize victims outside the normal revenue-sharing model, and they urged organizations to preserve the messages as evidence and work with incident responders and law enforcement rather than pay the actor.
Aug 20, 2026