Global Group - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/global-group/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 22 Sep 2026 20:01:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGlobal Group Ransomware-as-a-Service Operationshttps://feed.craftedsignal.io/briefs/2026-09-global-group-ransomware/Tue, 22 Sep 2026 20:01:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-global-group-ransomware/The Global Group, a RaaS operation evolved from Black Lock and Mamona, distributes ransomware via phishing-delivered ISO files and legitimate tool abuse to perform double-extortion attacks.The Global Group is a financially motivated Ransomware-as-a-Service (RaaS) operation that recently emerged as a rebranding of the legacy Black Lock and Mamona ransomware families. By inheriting established backend infrastructure and reusing core code artifacts, the group has quickly scaled its extortion activities. The group primarily targets large-scale enterprises across multiple industries, utilizing "double extortion" tactics where sensitive data is stolen and leaked publicly if ransom demands are not met. They coordinate closely with Initial Access Brokers (IABs) to facilitate network entry. Their delivery method relies on social engineering through phishing emails that pose as "Suggested Payment Plans," leading victims to malicious download sites that serve ISO-based payloads. The operation uses legitimate Windows tools to masquerade malicious activity, effectively bypassing traditional perimeter defenses before deploying encryption toolkits in the C:\Python27.x86 directory.

Attack Chain

  1. Phishing: Attacker sends an email posing as a payment plan, containing a PDF document ("document_989399.pdf").
  2. Redirection: The PDF contains a button linking to a malicious site (hXXps://driverupdate[.]sbs/access[.]php) to prompt a file download.
  3. Payload Delivery: The victim downloads a malicious ISO file ("Preview-9dc7.iso") containing a shortcut and an executable.
  4. Execution: The user runs the executable, which spawns a legitimate process, "WinMerge.exe", to mask subsequent network activity.
  5. C2 Communication: The compromised process connects to "hXXps://globalsupportupdate[.]top" to download the primary encryptor ("enc.exe").
  6. Persistence/Execution: The encryptor drops toolkit components into "C:\Python27.x86" and initiates a scan of local drivers and network shares.
  7. Impact: The ransomware encrypts files using a proprietary cryptographic algorithm and appends the ".nZASJgT" extension.
  8. Extortion: The malware changes the desktop wallpaper and drops a "README.nZASJgT.txt" ransom note, initiating business-style negotiations for data recovery and silence.

Impact

The Global Group ransomware poses a significant threat to global enterprise operations, resulting in the loss of data availability through encryption and the compromise of confidential corporate information via double extortion. By framing negotiations as professional business transactions, the group creates high-pressure environments for victim organizations. Successful attacks result in operational downtime, potential regulatory fines, and reputational damage due to the threat of public data exposure.

Recommendation

  • Deploy the provided Sigma rule to detect the execution of "WinMerge.exe" when initiated from non-standard user profile paths or associated with suspicious network connections.
  • Monitor for the creation of files with the ".nZASJgT" extension on local disks and network shares as an early indicator of encryption activity.
  • Block the C2 infrastructure domains and URLs identified in the IOC section at the enterprise DNS resolver and proxy.
  • Audit for unauthorized file system modifications and directory creation within the "C:\Python27.x86" path.
]]>highthreatransomwarephishingdouble-extortion