Green Blood v2.0 — Golang-Based Double-Extortion Ransomware Targeting South Asia & Africa

Key facts for Green Blood v2.0 ransomware

Detection coverage for Green Blood v2.0 ransomware

As of 2026-04-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0320 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Green Blood Ransomware — Initial Execution and WMI System Profiling

Detects the initial execution phase of Green Blood ransomware: a Go-compiled binary creating the GREENBLOOD_ENCRYPTOR_MUTEX, performing WMI system profiling via Win32_ComputerSystemProduct queries, and spawning cmd.exe child processes for defense suppression. Correlates mutex creation with WMI discovery activity within a short time window to reduce false positives.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1082, T1059.003
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=17)
| eval is_mutex=if(EventCode=17 AND match(TargetObject, "GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D"), 1, 0)
| eval is_go_binary=if(EventCode=1 AND match(Image, ".*\\.exe$") AND (match(CommandLine, ".*GREENBLOOD.*") OR match(ParentImage, ".*\\explorer\.exe$")), 1, 0)
| eval is_wmi_profiling=if(EventCode=1 AND match(CommandLine, ".*Win32_ComputerSystemProduct.*"), 1, 0)
| stats earliest(_time) as first_seen latest(_time) as last_seen values(Image) as images values(CommandLine) as cmdlines max(is_mutex) as mutex_created max(is_go_binary) as go_binary_exec max(is_wmi_profiling) as wmi_profiling by Computer
| where mutex_created=1 OR (go_binary_exec=1 AND wmi_profiling=1)
| eval detection_time=strftime(first_seen, "%Y-%m-%d %H:%M:%S")
| table Computer detection_time images cmdlines mutex_created go_binary_exec wmi_profiling

Microsoft KQL

let timeframe = 24h;
let MutexEvents = DeviceEvents
| where Timestamp > ago(timeframe)
| where ActionType == "CreateMutex"
| where AdditionalFields has "GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D"
| project MutexTime=Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine;
let WmiProfiling = DeviceProcessEvents
| where Timestamp > ago(timeframe)
| where ProcessCommandLine has "Win32_ComputerSystemProduct"
| project WmiTime=Timestamp, DeviceName, FileName, ProcessCommandLine;
MutexEvents
| join kind=fullouter (WmiProfiling) on DeviceName
| where isnotempty(MutexTime) or isnotempty(WmiTime)
| project DeviceName, MutexTime, WmiTime, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: Green Blood Ransomware — Initial Execution and Mutex Creation
id: 7bc7e89d-924b-5984-9aed-d5ee7f7988df
status: experimental
description: Detects Green Blood ransomware mutex creation (GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D) and WMI system profiling during initial execution phase
references:
    - https://asec.ahnlab.com/en/92997/
    - https://foresiet.com/blog/reverse-engineering-green-blood-ransomware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/04/06
tags:
    - attack.execution
    - attack.t1204.002
    - attack.discovery
    - attack.t1082
    - attack.t1059.003
logsource:
    product: windows
    category: process_creation
detection:
    selection_mutex:
        CommandLine|contains: 'GREENBLOOD_ENCRYPTOR_MUTEX'
    selection_wmi:
        CommandLine|contains|all:
            - 'wmic'
            - 'Win32_ComputerSystemProduct'
    selection_go_binary:
        Image|endswith: '.exe'
        Hashes|contains:
            - '05294c9970f365c92e0b0f1250db678dc356dbf418dba27bdd5eeb68487a7199'
            - '12bba7161d07efcb1b14d30054901ac9ffe5202972437b0c47c88d71e45c7176'
    condition: selection_mutex or selection_wmi or selection_go_binary
falsepositives:
    - Legitimate Go applications creating similarly named mutexes (unlikely given specificity)
    - System inventory tools querying Win32_ComputerSystemProduct
level: critical

Known false positives:

• Legitimate Go applications creating similarly named mutexes (unlikely given specificity)
• System inventory tools querying Win32_ComputerSystemProduct via WMI

Tuning notes: Add hash-based allowlisting for known Go binaries in the environment. Tune WMI profiling detection to exclude authorized asset inventory tools. Combine with mutex detection for higher confidence.

• 🔒 Green Blood Ransomware — Go Binary Execution with WMI System Profiling (KQL) · unlock with TL Creds
• 🔒 Green Blood Ransomware — Windows Defender Tampering and Recovery Suppression (KQL) · unlock with TL Creds
• 🔒 Green Blood Ransomware — Ransom Note Deployment and Cleanup Script Execution (KQL) · unlock with TL Creds
• 🔒 Green Blood Ransomware — Mutex Creation and Go Binary Execution (Sigma) · unlock with TL Creds
• 🔒 Green Blood Ransomware — Comprehensive Defense Evasion Chain (Sigma) · unlock with TL Creds
• 🔒 Green Blood Ransomware — Encryption Artifacts and Anti-Forensics (Sigma) · unlock with TL Creds
• 🔒 Green Blood Ransomware — Defense Suppression Command Chain · unlock with TL Creds
• 🔒 Green Blood Ransomware — Mass File Encryption and Self-Deletion · unlock with TL Creds

Indicators of compromise for Green Blood v2.0 ransomware

As of 2026-04-05, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-0320.

Sample indicators (3 of 20)

• Domain: scbrksw5fgjtujc2ah42roo6bij2unr2tggfcynpbql5a7yp3s22taid[.]onion
• File hash: 05294c9970f365c92e0b0f1250db678dc356dbf418dba27bdd5eeb68487a7199
• Email address: thegreenblood[@]proton[.]me

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How Green Blood v2.0 ransomware works

Version 2.0 is decryptable due to a critical key-recovery weakness in its Recovery Token XOR scheme.

Green Blood is a financially motivated ransomware group first observed in late January 2026, operating as a standalone double-extortion operation rather than a Ransomware-as-a-Service (RaaS) model. The group deploys a custom Golang-based ransomware payload compiled for Windows x64 (AMD64) using go1.24.2.

## Technical Architecture

The ransomware binary is a fully statically linked Go executable with no compiler-level obfuscation. Runtime symbols remain readable, and string protection is minimal, making reverse engineering relatively straightforward. The binary lacks network share discovery, lateral movement logic, or built-in exfiltration capabilities — it encrypts local drives only and must be manually deployed per target system.

## Encryption Implementation

Version 2.0 employs AES-256-CTR encryption, while the earlier v1.0 used ChaCha8 (an 8-round variant of ChaCha20). Key generation uses crypto/rand.Read() to produce a cryptographically secure 32-byte random key. A single key is reused across all files on a given system. Each file receives a unique 16-byte initialization vector (IV) stored at the file beginning, with encryption performed in 1MB increments. The ransomware spawns 50 parallel goroutine workers for high-throughput encryption, achieving hundreds of GB/hour.

## Critical Decryption Weakness (v2.0)

A fundamental design flaw enables key recovery without paying ransom. The ransomware generates a 16-byte Machine ID from the hostname, Windows version, and MAC address. The Recovery Token displayed in ransom notes is produced by XORing the 32-byte AES key with the Machine ID. Since the Machine ID can be reconstructed from system attributes, the AES key can be recovered by reversing the XOR operation using the Recovery Token from the ransom note. This weakness stems from the absence of asymmetric cryptography or remote key escrow.

## Execution Flow

1. Mutex check (Global\GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D) to prevent duplicate instances 2. System profiling via WMI to collect system UUID and generate Machine ID 3. Encryption key generation (32-byte via crypto/rand) 4. Recovery Token generation (key XOR Machine ID) 5. Defense suppression: Volume Shadow Copy deletion (vssadmin, wmic shadowcopy), Windows Recovery Environment disabled (bcdedit), Windows Defender real-time monitoring disabled (registry modification — contains syntax error in current version), Windows Firewall disabled (netsh advfirewall), backup catalog removal (wbadmin) 6. File enumeration targeting 140+ extensions while excluding system-critical extensions (exe, dll, sys, etc.), files under 100 bytes, and files over 50GB 7. Parallel encryption via 50 goroutine workers from shared queue 8. Ransom note deployment to desktop (hardcoded template with Recovery Token, Machine ID, contact info) 9. Self-deletion via cleanup_greenblood.bat with 5-second delay from %LOCALAPPDATA%\Temp

## Double-Extortion Operations

Despite the ransomware binary lacking built-in exfiltration capabilities, the group claims massive data theft using separate tooling. They operate a Tor-based leak portal (Python SimpleHTTP 0.6 on Python 3.9.2) listing victims with compromised domains, data sizes, and categorized datasets. Payment is Bitcoin-only with a 7-day deadline, escalating price structure, and 21-day key destruction threat.

## Victimology

Confirmed victims span India, Belgium, Egypt, Senegal, and Colombia. The most significant breach targeted Senegal's Directorate of Administrative Affairs (DAF), the national biometric identification system, with the group claiming exfiltration of 139 TB of data including biometric records, identity documents, and electoral data. ECOBAT was also breached with 6 TB claimed exfiltrated.

## Assessment

Green Blood represents a notable threat due to its targeting of government critical infrastructure in developing nations. The asymmetry between sophisticated data theft operations and a relatively immature ransomware payload suggests the group may prioritize data exfiltration and extortion over encryption-based disruption. The lack of affiliate infrastructure, obfuscation, and network propagation capabilities indicates early-stage operations likely to mature. Cross-compilation risk exists for Linux variants given the Golang codebase.

MITRE ATT&CK techniques by tactic:

collection

T1005 Data from Local System

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter; T1204 User Execution

defense-evasion

T1070 Indicator Removal

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

command-and-control

T1090 Proxy; T1571 Non-Standard Port

initial-access

T1189 Drive-by Compromise; T1566 Phishing

impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot

defense-impairment

T1685 Disable or Modify Tools

Remediation for Green Blood v2.0 ransomware

Immediate actions

• Block known contact emails (thegreenblood@proton.me, thegreenblood@onionmail.org) at email gateway
• Block Tor exit node traffic at perimeter firewall
• Deploy file integrity monitoring on critical data repositories
• Verify Volume Shadow Copy Service is running and protected
• Hunt for mutex Global\GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D across endpoints
• Search for .tgbg and .gblood file extensions indicating active encryption

Workarounds

• For v2.0 infections: Recovery Token XOR with Machine ID recovers AES key — decryption possible without payment
• Machine ID can be reconstructed from hostname, Windows version, and MAC address
• Use stored IV values at file headers to decrypt individual files after key recovery

Longer-term hardening

• Deploy EDR with behavioral detection for mass file encryption patterns
• Implement network segmentation to limit blast radius
• Establish immutable offline backup strategy with regular testing
• Monitor for Go-compiled binaries executing vssadmin or bcdedit commands
• Implement application whitelisting on critical servers
• Deploy canary files to detect encryption activity early

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows x64 (all versions)

Timeline of Green Blood v2.0 ransomware

• 2026-01-15 Green Blood ransomware group first observed in the wild with initial v1.0 payload using ChaCha8 encryption
• 2026-01-22 Dark Reading reports breach of Senegal's DAF national biometric ID system with 139 TB data exfiltration claimed by Green Blood Group
• 2026-01-28 Foresiet publishes reverse engineering analysis of Green Blood ransomware binary, documenting Go-based architecture and encryption weaknesses
• 2026-02-01 ANY.RUN begins tracking GREENBLOOD malware family with sandbox analysis results
• 2026-02-04 Green Blood Tor-based leak portal confirmed active, listing victims with compromised domains and data sizes
• 2026-02-09 Red Piranha includes Green Blood in weekly threat intelligence report, documenting Tor infrastructure details
• 2026-02-10 ECOBAT breach claimed by Green Blood Group with 6 TB data exfiltrated
• 2026-02-15 P4p4 M4n3 publishes detailed Go binary reverse engineering on Medium, confirming weak OPSEC and no obfuscation
• 2026-02-20 ASEC (AhnLab) publishes comprehensive analysis of Green Blood v2.0 with AES-256-CTR encryption and documents Recovery Token XOR decryption weakness
• 2026-03-15 Cynet includes Green Blood in March 2026 ransomware groups to watch report alongside Qilin and 0APT
• 2026-03-30 Last confirmed Green Blood activity observed per ANY.RUN tracking data
• 2026-05-29 As of 2026-05-29, Green Blood Group remains undisrupted (no arrests/takedown) but has gone quiet, with last confirmed activity ~2026-03-30 and no new victims in April-May; its leak site lapsed and v2.0's XOR Recovery Token flaw makes its encryption decryptable. The actor and reusable Go tooling persist and could resurge, warranting continued monitoring rather than resolution.

Sources cited for Green Blood v2.0 ransomware

• ASEC — Green Blood v2.0 ransomware analysis with decryption asec.ahnlab.com · Research · 2026-02-20
• Foresiet — Reverse Engineering Green Blood Ransomware foresiet.com · Research · 2026-01-28
• P4p4 M4n3 — Reverse Engineering a Go-Based Ransomware medium.com · Research · 2026-02-15
• ANY.RUN — GREENBLOOD Malware Analysis Overview any.run · Research · 2026-02-10
• Cynet — Qilin, Green Blood, 0APT: Ransomware Groups to Watch cynet.com · Blog · 2026-03-15
• ASEC — January 2026 Threat Trend Report on Ransomware asec.ahnlab.com · Blog · 2026-01-31
• Red Piranha — Threat Intelligence Report Feb 3-9, 2026 redpiranha.net · Blog · 2026-02-09
• Dark Reading — Senegalese Data Breaches Expose Lack of Security Maturity Dark Reading · News · 2026-01-22

Threats related to Green Blood v2.0 ransomware

• VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi
• GIBCRYPTO Destructive Ransomware with Snake Keylogger Shared Telegram C2 Infrastructure
• The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program
• CVE-2025-29824: Windows CLFS Use-After-Free Privilege Escalation Chained with Cisco ASA Compromise and PipeMagic/Storm-2460 Ransomware Attacks

Previous and next in ransomware

• Human-Operated Ransomware via GPO Abuse — Domain-Wide Encryption Through Group Policy Weaponization Previous report
• Coinbase Cartel — Data Exfiltration-Only Ransomware Group Targeting Healthcare, Tech & Transportation Next report