Exploring the Global Group Ransomware Threat

On October 16, 2025, cybersecurity circles were buzzing about the Global Group, a new contender in the Ransomware-as-a-Service (RaaS) arena that originally launched in June 2025. Fronted by a Russian-speaking figure known as “$$$”, the group has quickly gained traction across various underground forums. For affiliates, Global Group offers an enticing toolkit: competitive revenue shares, a mobile-friendly management interface, customizable malware payloads, and AI-enhanced negotiation tools. These elements make the extortion process almost seamless for its partners.

In-depth analyses suggest that Global Group shares much in common with former threats like Mamona and BlackLock. Similarities include overlapping infrastructures, identical mutex usage, and shared code for both encryption and communication processes. Even the ransom note design and negotiation tactics echo those of its predecessors. This resemblance strongly hints that Global Group could be a rebrand or an evolution rather than something entirely new.

Defending Against Global Group’s Advanced Techniques

The Global Group utilizes Go, making their ransomware operable across systems like Windows, Linux, and macOS. It stands out with features like LDAP spreading, token impersonation, and tailored execution modes. Its ChaCha20-Poly1305 encryption is swift, encrypting smaller files fully and restricting larger ones to 20% to maintain speed. Additionally, it disables system recovery, halts antivirus and endpoint defenses, erases logs, and deletes backups to ramp up disruption.

To combat such threats, organizations can turn to AttackIQ’s new attack graph. This tool simulates Global Group’s methods, allowing businesses to test their defenses. Key strategies include assessing security control effectiveness, defending against opportunistic attackers, and continuously refining detection and prevention systems using an operational playbook gleaned from real-world ransomware activities.

Ayelen Torello, an Adversary Research Engineer at AttackIQ, stresses the importance of these practical emulations. They’re a springboard for organizations to repeatedly test their security measures against current threats. Through resources like the AttackIQ Academy, the company is dedicated to strengthening the global cybersecurity community, providing tools and learning opportunities to better prepare against ransomware like Global Group.

**Secure your digital landscape today!** Learn how Qsentinel can safeguard your assets from ransomware and other cyber threats. Protecting your business has never been more critical. **Contact Qsentinel to get started.**

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.