Green Blood v2.0 — Golang-Based Double-Extortion Ransomware Targeting South Asia & Africa — Threadlinqs Intelligence
As of 2026-05-30, Green Blood v2.0 — Golang-Based Double-Extortion Ransomware Targeting South Asia & Africa is a high-severity ransomware threat attributed to The Green Blood Group (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0320 · Severity: HIGH · Status: MONITORING · Category: RANSOMWARE
Attribution: The Green Blood Group · Russia · FINANCIAL
Green Blood Group is an emerging double-extortion ransomware operation active since January 2026, deploying a Golang-based Windows x64 payload with AES-256-CTR encryption (v2.0) and ChaCha8 (v1.0).
Green Blood is a financially motivated ransomware group first observed in late January 2026, operating as a standalone double-extortion operation rather than a Ransomware-as-a-Service (RaaS) model. The group deploys a custom Golang-based ransomware payload compiled for Windows x64 (AMD64) using go1.24.2.
## Technical Architecture
The ransomware binary is a fully statically linked Go executable with no compiler-level obfuscation. Runtime symbols remain readable, and string protection is minimal, making reverse engineering relatively straightforward. The binary lacks network share discovery, lateral movement logic, or built-in exfiltration capabilities — it encrypts local drives only and must be manually deployed per target system.
## Encryption Implementation
Version 2.0 employs AES-256-CTR encryption, while the earlier v1.0 used ChaCha8 (an 8-round variant of ChaCha20). Key generation uses crypto/rand.Read() to produce a cryptographically secure 32-byte random key. A single key is reused across all files on a given system. Each file receives a unique 16-byte initialization vector (IV) stored at the file beginning, with encryption performed in 1MB increments. The ransomware spawns 50 parallel goroutine workers for high-throughput encryption, achieving hundreds of GB/hour.
## Critical Decryption Weakness (v2.0)
A fundamental design flaw enables key recovery without paying ransom. The ransomware generates a 16-byte Machine ID from the hostname, Windows version, and MAC address. The Recovery Token displayed in ransom notes is produced by XORing the 32-byte AES key with the Machine ID. Since the Machine ID can be reconstructed from system attributes, the AES key can be recovered by reversing the XOR operation using the Recovery Token from the ransom note. This weakness stems from the absence of asymmetric cryptography or remote key escrow.
## Execution Flow
1. Mutex check (Global\GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D) to prevent duplicate instances
2. System profiling via WMI to collect system UUID and generate Machine ID
3. Encryption key generation (32-byte via crypto/rand)
4. Recovery Token generation (key XOR Machine ID)
5. Defense suppression: Volume Shadow Copy deletion (vssadmin, wmic shadowcopy), Windows Recovery Environment disabled (bcdedit), Windows Defender real-time monitoring disabled (registry modification — contains syntax error in current version), Windows Firewall disabled (netsh advfirewall), backup catalog removal (wbadmin)
6. File enumeration targeting 140+ extensions while excluding system-critical extensions (exe, dll, sys, etc.), files under 100 bytes, and files over 50GB
7. Parallel encryption via 50 goroutine workers from shared queue
8. Ransom note deployment to desktop (hardcoded template with Recovery Token, Machine ID, contact info)
9. Self-deletion via cleanup_greenblood.bat with 5-second delay from %LOCALAPPDATA%\Temp
## Double-Extortion Operations
Despite the ransomware binary lacking built-in exfiltration capabilities, the group claims massive data theft using separate tooling. They operate a Tor-based leak portal (Python SimpleHTTP 0.6 on Python 3.9.2) listing victims with compromised domains, data sizes, and categorized datasets. Payment is Bitcoin-only with a 7-day deadline, escalating price structure, and 21-day key destruction threat.
## Victimology
Confirmed victims span India, Belgium, Egypt, Senegal, and Colombia. The most significant breach targeted Senegal's Directorate of Administrative Affairs (DAF), the national biometric identification system, with the group claiming exfiltration of 139 TB of data including biometric records, identity documents, and electoral data. ECOBAT was also breached with 6 TB claimed exfiltrated.
## Assessment
Green Blood represents a notable threat due to its targeting of government critical infrastructure in developing nations. The asymmetry between sophisticated data theft operations and a relatively immature ransomware payload suggests the group
Target sectors: government, critical-infrastructure, energy, manufacturing, financial
Target regions: South Asia, Africa, South America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1566, T1189, T1204, T1059, T1562, T1070, T1562, T1082, T1083, T1005