Vectra AI is named a Leader in the 2025 Gartner Magic Quadrant for Network Detection and Response (NDR). >
NEW

Vectra AI is named a Leader in the 2025 Gartner Magic Quadrant for Network Detection and Response (NDR).    Download Report. >

Vectra AI、2025年ガートナーのネットワーク検知とレスポンス (NDR) のマジック・クアドラントにおいてリーダーの1社に
Hamburger icon top line
Hamburger icon middle line
Hamburger icon bottom line
  1. Threat actors
    >
  2. Ransomware Group

GLOBAL GROUP

GLOBAL GROUP is a newly emerged Ransomware-as-a-Service (RaaS) operation launched in June 2025 by a known Russian-speaking threat actor, offering AI-driven negotiation, mobile control panels, and aggressive affiliate incentives to rapidly expand its reach across global industries.

Is Your Organization Safe from GLOBAL Ransomware Attacks?
Background & targets
TTPs
MITRE Mapping
Detection
FAQs
Watch Threat Briefing
BACKGROUND
COUNTRIES
INDUSTRIES
VICTIMS

The Origin of GLOBAL

GLOBAL GROUP is an emerging Ransomware-as-a-Service (RaaS) platform first observed on June 2, 2025, introduced by a threat actor using the alias "$$$" on the Ramp4u cybercrime forum. The actor has a history with previous ransomware strains including Mamona RIP and Black Lock (formerly El Dorado). Analysts assess with medium to high confidence that GLOBAL GROUP represents a rebranding of Black Lock, aimed at rebuilding credibility and expanding its affiliate base. The group's infrastructure is hosted via Russian VPS providers (notably IpServer), which was also used by its predecessor Mamona RIP.

GLOBAL GROUP promotes a revenue model that offers up to 85% profit share to affiliates, provides a mobile-friendly affiliate panel, and integrates AI-powered negotiation bots for non-English-speaking affiliates. Its malware is cross-platform capable (Windows, ESXi, Linux, BSD), and it boasts EDR evasion features.

Source: EclecticIQ

Global Ransomware ransom note
Global Ransomware ransom note

Countries Affected by GLOBAL

Confirmed victims span across multiple countries, with notable activity in the United States, United Kingdom, Australia, and Brazil. This global focus highlights the group's intent to maximize ransom potential by focusing on high-income, infrastructure-rich targets.

Industries Targeted by GLOBAL

GLOBAL GROUP targets a wide range of industries, with a strong emphasis on healthcare, oil and gas, industrial engineering, automotive services, and business process outsourcing. The group tailors its ransomware builds for both general-purpose environments and virtualized infrastructure like VMware ESXi.

Healthcare

Energy and Utilities

Critical National Infrastructure (CNI)

GLOBAL's Known Victims

  • Healthcare providers in the United States and Australia
  • Oil & gas equipment manufacturers in Texas, USA
  • Precision engineering firms and automotive services in the UK
  • Facilities management and BPO companies in Brazil

The group claimed 30 victims so far, including nine victims within five days of its debut, indicating rapid deployment and scalability.

Global Ransomware victims count
Source: Ransomware.live

‍

Attack Method

Global's Attack Method

Initial Access
Privilege Escalation
Persistence & Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Execution
Exfiltration
Impact
A shadowy figure casting a wide net over a digital landscape filled with various devices such as computers, smartphones, and tablets. The net symbolizes the attacker's attempts to find vulnerabilities or use phishing techniques to gain unauthorized access.

Purchased access from Initial Access Brokers (IABs), brute-forced VPNs, RDWeb, and Outlook portals. Exploits Fortinet, Palo Alto, and Cisco devices.

A digital ladder extending upwards from a basic user icon towards a crown symbolizing administrative privileges. This represents the attacker's efforts to gain higher-level access within the system.

Leverages webshells and valid credentials to gain domain user or local admin access.

A chameleon blending into a digital background, with zeroes and ones flowing around it. This represents the attacker's ability to avoid detection by security measures, changing tactics to blend in with normal network traffic.

Bypasses traditional EDR, uses legitimate credentials, and deploys malware compiled in Golang for stealth.

A thief with a lockpick toolkit working on a giant keyhole shaped like a login form, representing the attacker's efforts to steal user credentials to gain unauthorized access.

Harvests cached credentials, conducts password spraying, and uses custom tools provided by IAB partners.

A magnifying glass moving over a digital map of a network, highlighting files, folders, and network connections. This image represents the phase where attackers explore the environment to understand the structure and where valuable data resides.

Maps domain environments, identifies ESXi hosts, and performs network enumeration using built-in tools.

A series of interconnected nodes with a shadowy figure moving stealthily between them. This illustrates the attacker's movements within the network, seeking to gain control of additional systems or spread malware.

Moves laterally using SMB, malicious service creation, and remote shell sessions across the environment.

A large vacuum sucking up files, data icons, and folders into a bag held by a shadowy figure. This image symbolizes the process of gathering valuable data from the target network.

Exfiltrates sensitive files including legal, financial, and healthcare data before ransomware deployment.

A command prompt window open in front of a digital background, with malicious code being typed out. This represents the phase where attackers execute their malicious payload within the compromised system.

Executes ransomware across endpoints and hypervisors, encrypting VMs in parallel using Go-based binaries.

A series of files being funneled through a covert channel out of a computer to a cloud labeled with a skull, symbolizing the unauthorized transfer of data to a location controlled by the attacker.

Uses Tor-based infrastructure and misconfigured APIs to store and manage stolen data.

A cracked screen with a digital cityscape in chaos behind it, symbolizing the destructive impact of the cyberattack, such as service disruption, data destruction, or financial loss.

Delivers ransom notes, threatens public leaks on Tor DLS, and demands seven-figure payouts, often $1M or more.

A shadowy figure casting a wide net over a digital landscape filled with various devices such as computers, smartphones, and tablets. The net symbolizes the attacker's attempts to find vulnerabilities or use phishing techniques to gain unauthorized access.
Initial Access

Purchased access from Initial Access Brokers (IABs), brute-forced VPNs, RDWeb, and Outlook portals. Exploits Fortinet, Palo Alto, and Cisco devices.

A digital ladder extending upwards from a basic user icon towards a crown symbolizing administrative privileges. This represents the attacker's efforts to gain higher-level access within the system.
Privilege Escalation

Leverages webshells and valid credentials to gain domain user or local admin access.

A chameleon blending into a digital background, with zeroes and ones flowing around it. This represents the attacker's ability to avoid detection by security measures, changing tactics to blend in with normal network traffic.
Defense Evasion

Bypasses traditional EDR, uses legitimate credentials, and deploys malware compiled in Golang for stealth.

A thief with a lockpick toolkit working on a giant keyhole shaped like a login form, representing the attacker's efforts to steal user credentials to gain unauthorized access.
Credential Access

Harvests cached credentials, conducts password spraying, and uses custom tools provided by IAB partners.

A magnifying glass moving over a digital map of a network, highlighting files, folders, and network connections. This image represents the phase where attackers explore the environment to understand the structure and where valuable data resides.
Discovery

Maps domain environments, identifies ESXi hosts, and performs network enumeration using built-in tools.

A series of interconnected nodes with a shadowy figure moving stealthily between them. This illustrates the attacker's movements within the network, seeking to gain control of additional systems or spread malware.
Lateral Movement

Moves laterally using SMB, malicious service creation, and remote shell sessions across the environment.

A large vacuum sucking up files, data icons, and folders into a bag held by a shadowy figure. This image symbolizes the process of gathering valuable data from the target network.
Collection

Exfiltrates sensitive files including legal, financial, and healthcare data before ransomware deployment.

A command prompt window open in front of a digital background, with malicious code being typed out. This represents the phase where attackers execute their malicious payload within the compromised system.
Execution

Executes ransomware across endpoints and hypervisors, encrypting VMs in parallel using Go-based binaries.

A series of files being funneled through a covert channel out of a computer to a cloud labeled with a skull, symbolizing the unauthorized transfer of data to a location controlled by the attacker.
Exfiltration

Uses Tor-based infrastructure and misconfigured APIs to store and manage stolen data.

A cracked screen with a digital cityscape in chaos behind it, symbolizing the destructive impact of the cyberattack, such as service disruption, data destruction, or financial loss.
Impact

Delivers ransom notes, threatens public leaks on Tor DLS, and demands seven-figure payouts, often $1M or more.

MITRE ATT&CK Mapping

TTPs used by GLOBAL

TA0001: Initial Access
T1190
Exploit Public-Facing Application
TA0002: Execution
T1203
Exploitation for Client Execution
TA0003: Persistence
T1053
Scheduled Task/Job
TA0004: Privilege Escalation
T1068
Exploitation for Privilege Escalation
T1053
Scheduled Task/Job
TA0005: Defense Evasion
T1027
Obfuscated Files or Information
TA0006: Credential Access
T1110
Brute Force
TA0007: Discovery
T1135
Network Share Discovery
T1046
Network Service Discovery
TA0008: Lateral Movement
T1021
Remote Services
TA0009: Collection
No items found.
TA0011: Command and Control
No items found.
TA0010: Exfiltration
T1567
Exfiltration Over Web Service
T1041
Exfiltration Over C2 Channel
T1020
Automated Exfiltration
TA0040: Impact
T1486
Data Encrypted for Impact
Platform Detections

How to Detect GLOBAL with Vectra AI

List of the Detections available in the Vectra AI Platform that would indicate a ransomware attack.

M365 Malware Stage: Upload

Privilege Anomaly: Unusual Host

SQL Injection Activity

View more detections
Assess your attack exposure

Is Your Organization Safe from GLOBAL Ransomware Attacks?

Assess your attack exposure

FAQs