Green Blood v2.0 — Golang-Based Double-Extortion Ransomware Targeting South Asia & Africa
Green Blood v2.0 (TL-2026-0320), also tracked as Green Blood v2.0, is a high-severity ransomware operation, first published 2026-04-05. It is attributed to The Green Blood Group (Russia) with medium confidence, affects Microsoft Windows, maps to 15 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0320
- Threat ID
- TL-2026-0320
- Also known as
- Green Blood v2.0, GREENBLOOD, GreenBlood Ransomware
- Severity
- HIGH
- Status
- MONITORING
- Category
- RANSOMWARE
- First published
- 2026-04-05
- Last reviewed
- 2026-04-05
- Attribution
- The Green Blood Group
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government, critical-infrastructure, energy, manufacturing, financial
- Target regions
- South Asia, Africa, South America, Europe
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Green Blood v2.0
Malware and tooling: Connection/EDR.Event.M11768, Execution/EDR.Malware.M10459, Ransomware/Win.GreenBlood.C584449, Ransomware/Win.GreenBlood.C584923
Green Blood Group is an emerging double-extortion ransomware operation active since January 2026, deploying a Golang-based Windows x64 payload with AES-256-CTR encryption (v2.0) and ChaCha8 (v1.0). The group breached Senegal's national biometric ID system (DAF), exfiltrating 139 TB of citizen data. Version 2.0 is decryptable due to a critical key-recovery weakness in its Recovery Token XOR scheme.
How Green Blood v2.0 works
Green Blood is a financially motivated ransomware group first observed in late January 2026, operating as a standalone double-extortion operation rather than a Ransomware-as-a-Service (RaaS) model. The group deploys a custom Golang-based ransomware payload compiled for Windows x64 (AMD64) using go1.24.2.
## Technical Architecture
The ransomware binary is a fully statically linked Go executable with no compiler-level obfuscation. Runtime symbols remain readable, and string protection is minimal, making reverse engineering relatively straightforward. The binary lacks network share discovery, lateral movement logic, or built-in exfiltration capabilities — it encrypts local drives only and must be manually deployed per target system.
## Encryption Implementation
Version 2.0 employs AES-256-CTR encryption, while the earlier v1.0 used ChaCha8 (an 8-round variant of ChaCha20). Key generation uses crypto/rand.Read() to produce a cryptographically secure 32-byte random key. A single key is reused across all files on a given system. Each file receives a unique 16-byte initialization vector (IV) stored at the file beginning, with encryption performed in 1MB increments. The ransomware spawns 50 parallel goroutine workers for high-throughput encryption, achieving hundreds of GB/hour.
## Critical Decryption Weakness (v2.0)
A fundamental design flaw enables key recovery without paying ransom. The ransomware generates a 16-byte Machine ID from the hostname, Windows version, and MAC address. The Recovery Token displayed in ransom notes is produced by XORing the 32-byte AES key with the Machine ID. Since the Machine ID can be reconstructed from system attributes, the AES key can be recovered by reversing the XOR operation using the Recovery Token from the ransom note. This weakness stems from the absence of asymmetric cryptography or remote key escrow.
## Execution Flow
1. Mutex check (Global\GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D) to prevent duplicate instances 2. System profiling via WMI to collect system UUID and generate Machine ID 3. Encryption key generation (32-byte via crypto/rand) 4. Recovery Token generation (key XOR Machine ID) 5. Defense suppression: Volume Shadow Copy deletion (vssadmin, wmic shadowcopy), Windows Recovery Environment disabled (bcdedit), Windows Defender real-time monitoring disabled (registry modification — contains syntax error in current version), Windows Firewall disabled (netsh advfirewall), backup catalog removal (wbadmin) 6. File enumeration targeting 140+ extensions while excluding system-critical extensions (exe, dll, sys, etc.), files under 100 bytes, and files over 50GB 7. Parallel encryption via 50 goroutine workers from shared queue 8. Ransom note deployment to desktop (hardcoded template with Recovery Token, Machine ID, contact info) 9. Self-deletion via cleanup_greenblood.bat with 5-second delay from %LOCALAPPDATA%\Temp
## Double-Extortion Operations
Despite the ransomware binary lacking built-in exfiltration capabilities, the group claims massive data theft using separate tooling. They operate a Tor-based leak portal (Python SimpleHTTP 0.6 on Python 3.9.2) listing victims with compromised domains, data sizes, and categorized datasets. Payment is Bitcoin-only with a 7-day deadline, escalating price structure, and 21-day key destruction threat.
## Victimology
Confirmed victims span India, Belgium, Egypt, Senegal, and Colombia. The most significant breach targeted Senegal's Directorate of Administrative Affairs (DAF), the national biometric identification system, with the group claiming exfiltration of 139 TB of data including biometric records, identity documents, and electoral data. ECOBAT was also breached with 6 TB claimed exfiltrated.
## Assessment
Green Blood represents a notable threat due to its targeting of government critical infrastructure in developing nations. The asymmetry between sophisticated data theft operations and a relatively immature ransomware payload suggests the group may prioritize data exfiltration and extortion over encryption-based disruption. The lack of affiliate infrastructure, obfuscation, and network propagation capabilities indicates early-stage operations likely to mature. Cross-compilation risk exists for Linux variants given the Golang codebase.
MITRE ATT&CK techniques used in TL-2026-0320
collection
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
defense-evasion
discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
command-and-control
T1090 Proxy; T1571 Non-Standard Port
initial-access
T1189 Drive-by Compromise; T1566 Phishing
impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot
defense-impairment
Affected products and versions in Green Blood v2.0
- Microsoft — Windows
Vulnerable versions: Windows x64 (all versions)
Remediation for Green Blood v2.0
Immediate actions
- Block known contact emails (thegreenblood@proton.me, thegreenblood@onionmail.org) at email gateway
- Block Tor exit node traffic at perimeter firewall
- Deploy file integrity monitoring on critical data repositories
- Verify Volume Shadow Copy Service is running and protected
- Hunt for mutex Global\GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D across endpoints
- Search for .tgbg and .gblood file extensions indicating active encryption
Workarounds
- For v2.0 infections: Recovery Token XOR with Machine ID recovers AES key — decryption possible without payment
- Machine ID can be reconstructed from hostname, Windows version, and MAC address
- Use stored IV values at file headers to decrypt individual files after key recovery
Longer-term hardening
- Deploy EDR with behavioral detection for mass file encryption patterns
- Implement network segmentation to limit blast radius
- Establish immutable offline backup strategy with regular testing
- Monitor for Go-compiled binaries executing vssadmin or bcdedit commands
- Implement application whitelisting on critical servers
- Deploy canary files to detect encryption activity early
Timeline of Green Blood v2.0
- Green Blood ransomware group first observed in the wild with initial v1.0 payload using ChaCha8 encryption
- Dark Reading reports breach of Senegal's DAF national biometric ID system with 139 TB data exfiltration claimed by Green Blood Group
- Foresiet publishes reverse engineering analysis of Green Blood ransomware binary, documenting Go-based architecture and encryption weaknesses
- ANY.RUN begins tracking GREENBLOOD malware family with sandbox analysis results
- Green Blood Tor-based leak portal confirmed active, listing victims with compromised domains and data sizes
- Red Piranha includes Green Blood in weekly threat intelligence report, documenting Tor infrastructure details
- ECOBAT breach claimed by Green Blood Group with 6 TB data exfiltrated
- P4p4 M4n3 publishes detailed Go binary reverse engineering on Medium, confirming weak OPSEC and no obfuscation
- ASEC (AhnLab) publishes comprehensive analysis of Green Blood v2.0 with AES-256-CTR encryption and documents Recovery Token XOR decryption weakness
- Cynet includes Green Blood in March 2026 ransomware groups to watch report alongside Qilin and 0APT
- Last confirmed Green Blood activity observed per ANY.RUN tracking data
- As of 2026-05-29, Green Blood Group remains undisrupted (no arrests/takedown) but has gone quiet, with last confirmed activity ~2026-03-30 and no new victims in April-May; its leak site lapsed and v2.0's XOR Recovery Token flaw makes its encryption decryptable. The actor and reusable Go tooling persist and could resurge, warranting continued monitoring rather than resolution.
Sources cited for Green Blood v2.0
- ASEC — Green Blood v2.0 ransomware analysis with decryption
- Foresiet — Reverse Engineering Green Blood Ransomware
- Cynet — Qilin, Green Blood, 0APT: Ransomware Groups to Watch
- Dark Reading — Senegalese Data Breaches Expose Lack of Security Maturity
- P4p4 M4n3 — Reverse Engineering a Go-Based Ransomware
- ANY.RUN — GREENBLOOD Malware Analysis Overview
- ASEC — January 2026 Threat Trend Report on Ransomware
- Red Piranha — Threat Intelligence Report Feb 3-9, 2026
Threats related to Green Blood v2.0
- VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi
- GIBCRYPTO Destructive Ransomware with Snake Keylogger Shared Telegram C2 Infrastructure
- The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program
- CVE-2025-29824: Windows CLFS Use-After-Free Privilege Escalation Chained with Cisco ASA Compromise and PipeMagic/Storm-2460 Ransomware Attacks
Detection coverage for TL-2026-0320
As of 2026-04-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0320 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.