# Green Blood v2.0 — Golang-Based Double-Extortion Ransomware Targeting South Asia & Africa

> Green Blood Group is an emerging double-extortion ransomware operation active since January 2026, deploying a Golang-based Windows x64 payload with AES-256-CTR encryption (v2.0) and ChaCha8 (v1.0). The group breached Senegal's national biometric ID system (DAF), exfiltrating 139 TB of citizen data. Version 2.0 is decryptable due to a critical key-recovery weakness in its Recovery Token XOR scheme.

- **Published:** 2026-04-05T12:00:00Z
- **Last reviewed:** 2026-04-05T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0320
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-green-blood-v2-0-ransomware-tl-2026-0320.webp?v=49aba9f4 (Threadlinqs threat intel: Green Blood Golang Ransomware Key Flaw: Analysis & Hunting (TL-2026-0320) — High severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-0320
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** The Green Blood Group (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Green Blood is a financially motivated ransomware group first observed in late January 2026, operating as a standalone double-extortion operation rather than a Ransomware-as-a-Service (RaaS) model. The group deploys a custom Golang-based ransomware payload compiled for Windows x64 (AMD64) using go1.24.2.

## Technical Architecture

The ransomware binary is a fully statically linked Go executable with no compiler-level obfuscation. Runtime symbols remain readable, and string protection is minimal, making reverse engineering relatively straightforward. The binary lacks network share discovery, lateral movement logic, or built-in exfiltration capabilities — it encrypts local drives only and must be manually deployed per target system.

## Encryption Implementation

Version 2.0 employs AES-256-CTR encryption, while the earlier v1.0 used ChaCha8 (an 8-round variant of ChaCha20). Key generation uses crypto/rand.Read() to produce a cryptographically secure 32-byte random key. A single key is reused across all files on a given system. Each file receives a unique 16-byte initialization vector (IV) stored at the file beginning, with encryption performed in 1MB increments. The ransomware spawns 50 parallel goroutine workers for high-throughput encryption, achieving hundreds of GB/hour.

## Critical Decryption Weakness (v2.0)

A fundamental design flaw enables key recovery without paying ransom. The ransomware generates a 16-byte Machine ID from the hostname, Windows version, and MAC address. The Recovery Token displayed in ransom notes is produced by XORing the 32-byte AES key with the Machine ID. Since the Machine ID can be reconstructed from system attributes, the AES key can be recovered by reversing the XOR operation using the Recovery Token from the ransom note. This weakness stems from the absence of asymmetric cryptography or remote key escrow.

## Execution Flow

1. Mutex check (Global\GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D) to prevent duplicate instances
2. System profiling via WMI to collect system UUID and generate Machine ID
3. Encryption key generation (32-byte via crypto/rand)
4. Recovery Token generation (key XOR Machine ID)
5. Defense suppression: Volume Shadow Copy deletion (vssadmin, wmic shadowcopy), Windows Recovery Environment disabled (bcdedit), Windows Defender real-time monitoring disabled (registry modification — contains syntax error in current version), Windows Firewall disabled (netsh advfirewall), backup catalog removal (wbadmin)
6. File enumeration targeting 140+ extensions while excluding system-critical extensions (exe, dll, sys, etc.), files under 100 bytes, and files over 50GB
7. Parallel encryption via 50 goroutine workers from shared queue
8. Ransom note deployment to desktop (hardcoded template with Recovery Token, Machine ID, contact info)
9. Self-deletion via cleanup_greenblood.bat with 5-second delay from %LOCALAPPDATA%\Temp

## Double-Extortion Operations

Despite the ransomware binary lacking built-in exfiltration capabilities, the group claims massive data theft using separate tooling. They operate a Tor-based leak portal (Python SimpleHTTP 0.6 on Python 3.9.2) listing victims with compromised domains, data sizes, and categorized datasets. Payment is Bitcoin-only with a 7-day deadline, escalating price structure, and 21-day key destruction threat.

## Victimology

Confirmed victims span India, Belgium, Egypt, Senegal, and Colombia. The most significant breach targeted Senegal's Directorate of Administrative Affairs (DAF), the national biometric identification system, with the group claiming exfiltration of 139 TB of data including biometric records, identity documents, and electoral data. ECOBAT was also breached with 6 TB claimed exfiltrated.

## Assessment

Green Blood represents a notable threat due to its targeting of government critical infrastructure in developing nations. The asymmetry between sophisticated data theft operations and a relatively immature ransomware payload suggests the group may prioritize data exfiltration and extortion over encryption-based disruption. The lack of affiliate infrastructure, obfuscation, and network propagation capabilities indicates early-stage operations likely to mature. Cross-compilation risk exists for Linux variants given the Golang codebase.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1571 Non-Standard Port
- T1090 Proxy
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1529 System Shutdown/Reboot

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Green Blood Ransomware — Initial Execution and WMI System Profiling** (`TL-2026-0320-SPL-001`)

Detects the initial execution phase of Green Blood ransomware: a Go-compiled binary creating the GREENBLOOD_ENCRYPTOR_MUTEX, performing WMI system profiling via Win32_ComputerSystemProduct queries, and spawning cmd.exe child processes for defense suppression. Correlates mutex creation with WMI discovery activity within a short time window to reduce false positives.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1082, T1059.003
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=17)
| eval is_mutex=if(EventCode=17 AND match(TargetObject, "GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D"), 1, 0)
| eval is_go_binary=if(EventCode=1 AND match(Image, ".*\\.exe$") AND (match(CommandLine, ".*GREENBLOOD.*") OR match(ParentImage, ".*\\explorer\.exe$")), 1, 0)
| eval is_wmi_profiling=if(EventCode=1 AND match(CommandLine, ".*Win32_ComputerSystemProduct.*"), 1, 0)
| stats earliest(_time) as first_seen latest(_time) as last_seen values(Image) as images values(CommandLine) as cmdlines max(is_mutex) as mutex_created max(is_go_binary) as go_binary_exec max(is_wmi_profiling) as wmi_profiling by Computer
| where mutex_created=1 OR (go_binary_exec=1 AND wmi_profiling=1)
| eval detection_time=strftime(first_seen, "%Y-%m-%d %H:%M:%S")
| table Computer detection_time images cmdlines mutex_created go_binary_exec wmi_profiling
```

### Microsoft KQL

```kql
let timeframe = 24h;
let MutexEvents = DeviceEvents
| where Timestamp > ago(timeframe)
| where ActionType == "CreateMutex"
| where AdditionalFields has "GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D"
| project MutexTime=Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine;
let WmiProfiling = DeviceProcessEvents
| where Timestamp > ago(timeframe)
| where ProcessCommandLine has "Win32_ComputerSystemProduct"
| project WmiTime=Timestamp, DeviceName, FileName, ProcessCommandLine;
MutexEvents
| join kind=fullouter (WmiProfiling) on DeviceName
| where isnotempty(MutexTime) or isnotempty(WmiTime)
| project DeviceName, MutexTime, WmiTime, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Green Blood Ransomware — Initial Execution and Mutex Creation
id: 7bc7e89d-924b-5984-9aed-d5ee7f7988df
status: experimental
description: Detects Green Blood ransomware mutex creation (GREENBLOOD_ENCRYPTOR_MUTEX_2A3B4C5D) and WMI system profiling during initial execution phase
references:
    - https://asec.ahnlab.com/en/92997/
    - https://foresiet.com/blog/reverse-engineering-green-blood-ransomware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/04/06
tags:
    - attack.execution
    - attack.t1204.002
    - attack.discovery
    - attack.t1082
    - attack.t1059.003
logsource:
    product: windows
    category: process_creation
detection:
    selection_mutex:
        CommandLine|contains: 'GREENBLOOD_ENCRYPTOR_MUTEX'
    selection_wmi:
        CommandLine|contains|all:
            - 'wmic'
            - 'Win32_ComputerSystemProduct'
    selection_go_binary:
        Image|endswith: '.exe'
        Hashes|contains:
            - '05294c9970f365c92e0b0f1250db678dc356dbf418dba27bdd5eeb68487a7199'
            - '12bba7161d07efcb1b14d30054901ac9ffe5202972437b0c47c88d71e45c7176'
    condition: selection_mutex or selection_wmi or selection_go_binary
falsepositives:
    - Legitimate Go applications creating similarly named mutexes (unlikely given specificity)
    - System inventory tools querying Win32_ComputerSystemProduct
level: critical
```

**Known false positives:**

- Legitimate Go applications creating similarly named mutexes (unlikely given specificity)
- System inventory tools querying Win32_ComputerSystemProduct via WMI

**Tuning notes:** Add hash-based allowlisting for known Go binaries in the environment. Tune WMI profiling detection to exclude authorized asset inventory tools. Combine with mutex detection for higher confidence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Green Blood Ransomware — Go Binary Execution with WMI System Profiling (KQL) (locked: unlock with TL Creds)
- Green Blood Ransomware — Windows Defender Tampering and Recovery Suppression (KQL) (locked: unlock with TL Creds)
- Green Blood Ransomware — Ransom Note Deployment and Cleanup Script Execution (KQL) (locked: unlock with TL Creds)
- Green Blood Ransomware — Mutex Creation and Go Binary Execution (Sigma) (locked: unlock with TL Creds)
- Green Blood Ransomware — Comprehensive Defense Evasion Chain (Sigma) (locked: unlock with TL Creds)
- Green Blood Ransomware — Encryption Artifacts and Anti-Forensics (Sigma) (locked: unlock with TL Creds)
- Green Blood Ransomware — Defense Suppression Command Chain (locked: unlock with TL Creds)
- Green Blood Ransomware — Mass File Encryption and Self-Deletion (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- Domain: `scbrksw5fgjtujc2ah42roo6bij2unr2tggfcynpbql5a7yp3s22taid[.]onion`
- File hash: `05294c9970f365c92e0b0f1250db678dc356dbf418dba27bdd5eeb68487a7199`
- Email address: `thegreenblood[@]proton[.]me`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ASEC — Green Blood v2.0 ransomware analysis with decryption](https://asec.ahnlab.com/en/92997/)
- [Foresiet — Reverse Engineering Green Blood Ransomware](https://foresiet.com/blog/reverse-engineering-green-blood-ransomware/)
- [Cynet — Qilin, Green Blood, 0APT: Ransomware Groups to Watch](https://www.cynet.com/blog/qilin-green-blood-0apt-ransomware-groups-to-watch-march-2026/)
- [Dark Reading — Senegalese Data Breaches Expose Lack of Security Maturity](https://www.darkreading.com/cyberattacks-data-breaches/hackers-breach-senegal-national-biometric-database)
- [P4p4 M4n3 — Reverse Engineering a Go-Based Ransomware](https://medium.com/@P4p4M4n3/reverse-engineering-a-go-based-ransomware-attributed-to-the-thegreenblood-group-e548a5e07d02)
- [ANY.RUN — GREENBLOOD Malware Analysis Overview](https://any.run/malware-trends/greenblood/)
- [ASEC — January 2026 Threat Trend Report on Ransomware](https://asec.ahnlab.com/en/92620/)
- [Red Piranha — Threat Intelligence Report Feb 3-9, 2026](https://redpiranha.net/news/threat-intelligence-report-february-3-february-9-2026)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0320