# Global Group RaaS (Black Lock/Mamona successor): Payment-Plan Phishing to ISO/LNK, WinMerge Loader and Ransomware Deployment

> Cofense reports Global Group, a financially motivated Ransomware-as-a-Service operation assessed as a rebrand of BlackLock and a successor to Mamona, delivering ransomware through payment-plan phishing emails with a PDF attachment. The PDF links to a malicious site serving an ISO with a loader executable and a PDF-masquerading LNK; the loader spawns a legitimate WinMerge process that fetches the encryptor (enc.exe), which encrypts files with the .nZASJgT extension and drops a ransom note.

- **Published:** 2026-10-07T00:00:00Z
- **Last reviewed:** 2026-10-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3028
- **ID:** TL-2026-3028
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Global Group
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Global Group is a Russian-speaking Ransomware-as-a-Service operation first advertised on the Ramp4u forum on 2 June 2025 by the actor "$$$" and officially launched on 26 June 2025. EclecticIQ assesses with medium confidence that it is a rebrand of BlackLock (itself a rebrand of Eldorado) after the BlackLock leak site was defaced by DragonForce in March 2025, and with high confidence that it is linked to the defunct Mamona operation, based on the shared Russian VPS provider IpServer, source-code similarity, and an identical mutex (Global\Fxo16jmdgujs437). Affiliates are offered an 85% revenue share (CyberInsider reports 87%). The ransomware is Go-compiled, uses ChaCha20-Poly1305, supports Windows, ESXi, NAS and BSD builds, can deploy domain-wide over SMB by creating malicious Windows services, and can self-delete, delete logs and terminate services. The negotiation panel uses AI-driven chatbots to help non-English-speaking affiliates. As of 14 July 2025 the group had claimed 17 victims in Australia, Brazil, the UK/Europe and the US across healthcare, oil-and-gas equipment fabrication, industrial machinery, precision engineering, automotive services, legal services and business process outsourcing.

The campaign documented by the Cofense Phishing Defense Center (22 September 2026) uses a different, email-driven delivery chain from the credential/edge-device access historically reported for the group. A phishing email posing as a business payment-plan notice for an outstanding balance, sent from a generic Hotmail address, carries a tiny PDF (document_989399.pdf, 1,798 bytes). The PDF's "Download" button redirects to hxxps://driverupdate[.]sbs/access.php?t=notes-a408df, which serves an ISO (Preview-9dc7.iso) containing a loader executable (Preview-9dc7.exe) and a shortcut disguised as a PDF (Preview-9dc7.pdf.lnk). Running the payload launches a legitimate WinMerge.exe process that connects to the attacker's server and retrieves the encryptor enc.exe (hxxps://globalsupportupdate[.]top/enc.exe). The ransomware toolkit is unpacked under C:\Python27.x86, security processes are disabled during encryption, files are renamed with the .nZASJgT extension, and a README ransom note is written. The note promises a decryption key and deletion of stolen data, offers cyber-insurance guidance and "reputation management", and frames payment as a legitimate transactional business expense, consistent with double extortion. Cofense also lists hxxps://playmounthdom[.]top/ and three IPs (172.67.175.15, 104.21.92.70, 172.67.188.157) that sit in Cloudflare address space and are likely fronting for the attacker domains.

In earlier reporting, initial access came mainly from Initial Access Brokers (RDP and web-shell access bought on Ramp4u; an IAB named HuanEbashes is cited), the actor's "Brute VPN" tool ($400) against Fortinet VPN, Palo Alto GlobalProtect, Cisco VPN, Outlook Web Access and RDWeb, and exploitation of internet-facing edge appliances. Defenders should treat both access paths as live: filter ISO/IMG/LNK delivery from email, monitor WinMerge.exe launched from removable or mounted ISO volumes making outbound connections, and harden remote-access services with MFA.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1566.001 Spearphishing Attachment
- T1078 Valid Accounts
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1021.002 SMB/Windows Admin Shares
- T1543.003 Windows Service
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [From Payment Plan to Ransomware - Inside a Global Group Attack (Cofense Phishing Defense Center)](https://cofense.com/blog/from-payment-plan-to-ransomware-inside-a-global-group-attack)
- [Malpedia library entry: Inside a Global Group Attack](https://malpedia.caad.fkie.fraunhofer.de/library/81a07075-a9a0-4d83-bb75-7e09a78c2d87/)
- [GLOBAL GROUP: Emerging Ransomware-as-a-Service (EclecticIQ)](https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service)
- [Newly Emerged Global Group RaaS Expands (The Hacker News)](https://thehackernews.com/2025/07/newly-emerged-global-group-raas-expands.html)
- [New Ransomware Operation Global Group Launches with AI Negotiators (CyberInsider)](https://cyberinsider.com/new-ransomware-operation-global-group-launches-with-ai-negotiators/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3028