Full Report
The Cofense Phishing Defense Center (PDC) team has recently investigated a newly emerged Ransomware-as-a-Service (RaaS) operation organized by the Global Group, a financially motivated cybercriminal group running a Ransomware-as-a-Service (RaaS) platform. Targeting high-value, large-scale enterprises across different industries, escalating threats to the global digital economy. Global Group is a rebranding of the legacy Black Lock and Mamona ransomware families by inheriting an established backend infrastructure, reusing core code artifacts, and launching an immediately scalable extortion enterprise.
Analysis Summary
# Threat Actor: Global Group (also referred to as Global Ransomware)
## Attribution & Identity
* **Identity:** A financially motivated cybercriminal group operating a Ransomware-as-a-Service (RaaS) platform.
* **Aliases/Legacy Families:** Global Group is a direct rebranding of the legacy **Black Lock** and **Mamona** ransomware families.
* **Associations:** The group partners heavily with Initial Access Brokers (IABs) to purchase pre-compromised corporate credentials, enabling affiliates to bypass perimeter defenses.
## Activity Summary
Global Group has recently emerged as a highly sophisticated RaaS operation. The group inherits an established backend infrastructure and reuses core code artifacts from its predecessors to launch an immediately scalable extortion enterprise. Their recent campaigns utilize phishing vectors delivering malicious PDF attachments to deploy an encryptor payload, followed by aggressive "double extortion" tactics.
## Tactics, Techniques & Procedures
* **Phishing/Social Engineering:** Delivers initial access payloads via phishing emails disguised as a "Suggested Payment Plan" sent from generic Hotmail domains to appear legitimate.
* **Malicious Lures & Redirects:** Employs a PDF attachment containing a fake "Download" button that redirects victims to a malicious landing page (`hXXps://driverupdate[.]sbs/access[.]php`).
* **ISO/LNK Delivery:** Downloads an ISO archive containing a malicious executable (`Preview-9dc7.exe`) and an LNK shortcut disguised as a PDF (`Preview-9dc7.pdf.lnk`) pointing to the executable.
* **Living-off-the-Land / Binary Proxy Execution:** Once executed, the loader spawns a legitimate, open-source file comparison tool (`WinMerge.exe`) to blend into network traffic and fetch the primary payload.
* **Payload Retrieval:** Connects to a Command and Control (C2) server to download the encryptor script (`enc.exe`).
* **System Discovery & Disabling Security:** Scans local drives, network shares, and databases, while actively disabling running security processes.
* **Data Encryption:** Executes a cryptographic algorithm that appends the `.nZASJgT` extension to compromised files.
* **Persistence & Environment Setup:** Drops a local toolkit and supporting scripts within the `C:\Python27.x86` directory path.
* **Impact/Extortion:** Changes the desktop wallpaper to a ransom note and drops detailed instructions (`README.nZASJgT.txt`).
* **Psychological Manipulation / Double Extortion:** Steals sensitive data prior to encryption and threatens public leaks. The group attempts to reduce payment hesitation by framing the ransom as a legitimate transactional business expense, offering decryption keys, cyber insurance claim documentation, and reputation management.
* **MITRE ATT&CK IDs:** None explicitly listed in the source text.
## Targeting
* **Sectors:** High-value, large-scale enterprises across various industries.
* **Geography:** Global scale (targeting the global digital economy/worldwide).
* **Victims:** No specific organizational names were provided in the text.
## Tools & Infrastructure
* **Malware Families:** Black Lock, Mamona, Global Ransomware (`enc.exe`, `ptc1591.exe`).
* **Infrastructure:**
* `hXXps://driverupdate[.]sbs/access[.]php?t=notes-a408df`
* `172[.]67[.]175[.]15`
* `hXXps://globalsupportupdate[.]top/enc[.]exe`
* `104[.]21[.]92[.]70`
* `hXXps://playmounthdom[.]top/`
* `172[.]67[.]188[.]157`
## Implications
Global Group presents a severe threat to modern business operations due to its ability to rapidly scale operations using recycled infrastructure and core code from legacy ransomware operations. By working with Initial Access Brokers and executing double extortion, they can cripple an enterprise's infrastructure and leverage sensitive data before internal security teams detect a breach. Their sophisticated negotiation framing indicates a highly structured, business-like model designed to maximize illicit profits.
## Mitigations
* **Proactive Threat Hunting:** Monitor networks for unauthorized access, focusing on credential abuse and signs of Initial Access Broker activity.
* **Email & Phishing Defenses:** Implement robust email filtering rules to detect and quarantine emails originating from generic public domains (like Hotmail) containing transactional lures and external redirection links.
* **Application Control & Monitoring:** Strictly monitor or restrict the execution of dual-use open-source tools (such as WinMerge) when spawned by unusual parent processes or when initiating inbound/outbound external web connections.
* **Network Segmentation & Access Controls:** Restrict access to critical network shares, local databases, and drivers to limit the lateral movement capabilities of the encryptor script.