Threat reportRansomwareTL-2026-3028
Global Group RaaS (Black Lock/Mamona successor): Payment-Plan Phishing to ISO/LNK, WinMerge Loader and Ransomware Deployment
Global Group RaaS (Black Lock/Mamona successor) (TL-2026-3028), also tracked as GLOBAL GROUP, is a high-severity ransomware operation, first published 2026-10-07. It is attributed to Global Group with medium confidence, affects Microsoft Windows, maps to 15 MITRE ATT&CK techniques (T1021.002, T1036, T1078), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 1Global Group
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-3028
- Threat ID
- TL-2026-3028
- Also known as
- GLOBAL GROUP, Global Group RaaS
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Global Group
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- health, manufacturing, energy, legal, business-services, automotive
- Target regions
- North America, Europe, australia, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Global Group RaaS (Black Lock/Mamona successor)
Malware and tooling: Global, Global Group ransomware, el dorado, mamona
How Global Group RaaS (Black Lock/Mamona successor) works
Cofense reports Global Group, a financially motivated Ransomware-as-a-Service operation assessed as a rebrand of BlackLock and a successor to Mamona, delivering ransomware through payment-plan phishing emails with a PDF attachment. The PDF links to a malicious site serving an ISO with a loader executable and a PDF-masquerading LNK; the loader spawns a legitimate WinMerge process that fetches the encryptor (enc.exe), which encrypts files with the .nZASJgT extension and drops a ransom note.
Global Group is a Russian-speaking Ransomware-as-a-Service operation first advertised on the Ramp4u forum on 2 June 2025 by the actor "$$$" and officially launched on 26 June 2025. EclecticIQ assesses with medium confidence that it is a rebrand of BlackLock (itself a rebrand of Eldorado) after the BlackLock leak site was defaced by DragonForce in March 2025, and with high confidence that it is linked to the defunct Mamona operation, based on the shared Russian VPS provider IpServer, source-code similarity, and an identical mutex (Global\Fxo16jmdgujs437). Affiliates are offered an 85% revenue share (CyberInsider reports 87%). The ransomware is Go-compiled, uses ChaCha20-Poly1305, supports Windows, ESXi, NAS and BSD builds, can deploy domain-wide over SMB by creating malicious Windows services, and can self-delete, delete logs and terminate services. The negotiation panel uses AI-driven chatbots to help non-English-speaking affiliates. As of 14 July 2025 the group had claimed 17 victims in Australia, Brazil, the UK/Europe and the US across healthcare, oil-and-gas equipment fabrication, industrial machinery, precision engineering, automotive services, legal services and business process outsourcing.
The campaign documented by the Cofense Phishing Defense Center (22 September 2026) uses a different, email-driven delivery chain from the credential/edge-device access historically reported for the group. A phishing email posing as a business payment-plan notice for an outstanding balance, sent from a generic Hotmail address, carries a tiny PDF (document_989399.pdf, 1,798 bytes). The PDF's "Download" button redirects to hxxps://driverupdate[.]sbs/access.php?t=notes-a408df, which serves an ISO (Preview-9dc7.iso) containing a loader executable (Preview-9dc7.exe) and a shortcut disguised as a PDF (Preview-9dc7.pdf.lnk). Running the payload launches a legitimate WinMerge.exe process that connects to the attacker's server and retrieves the encryptor enc.exe (hxxps://globalsupportupdate[.]top/enc.exe). The ransomware toolkit is unpacked under C:\Python27.x86, security processes are disabled during encryption, files are renamed with the .nZASJgT extension, and a README ransom note is written. The note promises a decryption key and deletion of stolen data, offers cyber-insurance guidance and "reputation management", and frames payment as a legitimate transactional business expense, consistent with double extortion. Cofense also lists hxxps://playmounthdom[.]top/ and three IPs (172.67.175.15, 104.21.92.70, 172.67.188.157) that sit in Cloudflare address space and are likely fronting for the attacker domains.
In earlier reporting, initial access came mainly from Initial Access Brokers (RDP and web-shell access bought on Ramp4u; an IAB named HuanEbashes is cited), the actor's "Brute VPN" tool ($400) against Fortinet VPN, Palo Alto GlobalProtect, Cisco VPN, Outlook Web Access and RDWeb, and exploitation of internet-facing edge appliances. Defenders should treat both access paths as live: filter ISO/IMG/LNK delivery from email, monitor WinMerge.exe launched from removable or mounted ISO volumes making outbound connections, and harden remote-access services with MFA.
MITRE ATT&CK techniques used in TL-2026-3028
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Defense Evasion
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment
Credential Access
Execution
T1204.001 Malicious Link; T1204.002 Malicious File
Impact
T1489 Service Stop; T1657 Financial Theft
Persistence
Resource Development
T1583.001 Domains; T1583.003 Virtual Private Server
defense-impairment
Affected products and versions in Global Group RaaS (Black Lock/Mamona successor)
- Microsoft — Windows
Vulnerable versions: Windows endpoints and servers (domain-joined environments) - VMware — ESXi
Vulnerable versions: ESXi hosts targeted by the Go encryptor build - Fortinet / Palo Alto Networks / Cisco — VPN and edge appliances
Vulnerable versions: Targeted by credential brute-forcing and edge-device exploitation in earlier Global Group reporting
Remediation for Global Group RaaS (Black Lock/Mamona successor)
Patches
- Keep VPN and edge appliances (Fortinet, Palo Alto, Cisco) on current vendor-patched firmware
Immediate actions
- Block the listed domains (driverupdate.sbs, globalsupportupdate.top, playmounthdom.top) and 193.19.119.4 at DNS, proxy and firewall; do not block the Cloudflare IPs alone as they are shared address space
- Hunt for Preview-9dc7.exe, Preview-9dc7.pdf.lnk, enc.exe, ptc1591.exe, the C:\Python27.x86 directory and files with the .nZASJgT extension
- Search for WinMerge.exe spawned from a mounted ISO or an unexpected parent and making outbound internet connections
- Isolate affected hosts and reset credentials if the encryptor or a README ransom note is found
Workarounds
- Application control allow-listing so WinMerge and unsigned executables cannot run from user-writable or mounted ISO paths
Longer-term hardening
- Block or strip ISO, IMG and LNK attachments and downloads at the email and web gateway; disable auto-mount of ISO files for standard users
- Enforce MFA and geo/conditional access on VPN, RDWeb and OWA; monitor for brute-force against Fortinet, Palo Alto GlobalProtect and Cisco VPN
- Alert on remote service creation over SMB and mass file renames; maintain offline, immutable backups including ESXi datastores
- Train users to treat payment-plan and balance-due PDFs with download buttons as suspicious
Timeline of Global Group RaaS (Black Lock/Mamona successor)
- In March 2025 the BlackLock RaaS data leak site was defaced by the DragonForce cartel; Global Group is later assessed as a BlackLock rebrand (exact day not reported)
- Actor "$$$" announces the GLOBAL GROUP RaaS on the Ramp4u forum with an 85% affiliate revenue share
- Official launch of the Global Group RaaS program, with Go-based builders for Windows, ESXi, NAS and BSD and an AI-driven negotiation panel
- Group has claimed 17 victims across Australia, Brazil, Europe and the US in healthcare, oil-and-gas equipment, industrial machinery, automotive, legal and BPO sectors
- EclecticIQ and press coverage publish analysis linking Global Group to BlackLock and Mamona via shared IpServer hosting, mutex and code similarity
- Cofense Phishing Defense Center publishes a payment-plan phishing campaign delivering Global Group ransomware via PDF, ISO/LNK, WinMerge loader and enc.exe
Sources cited for Global Group RaaS (Black Lock/Mamona successor)
- From Payment Plan to Ransomware - Inside a Global Group Attack (Cofense Phishing Defense Center)
- Malpedia library entry: Inside a Global Group Attack
- GLOBAL GROUP: Emerging Ransomware-as-a-Service (EclecticIQ)
- Newly Emerged Global Group RaaS Expands (The Hacker News)
- New Ransomware Operation Global Group Launches with AI Negotiators (CyberInsider)
Detection coverage for TL-2026-3028
As of 2026-10-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3028 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.