CampaignPublished 16 Jul 2025Updated 15 Aug 2025

Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates

Source AlienVault OTX General

Description

A new Ransomware-as-a-Service (RaaS) group called GLOBAL GROUP has emerged, likely a rebranding of the BlackLock RaaS operation. The group targets various sectors across the US and Europe, with a focus on healthcare providers. GLOBAL GROUP utilizes Initial Access Brokers to gain entry to vulnerable edge appliances and employs brute-force tools for Microsoft Outlook and RDWeb portals. Their ransom negotiation panel features AI-driven chatbots, enabling non-English-speaking affiliates to engage victims more effectively. The group offers an 85% revenue share to affiliates and provides a mobile-friendly control panel. GLOBAL GROUP's infrastructure has been traced to a Russia-based VPS provider, and their operations show similarities to previous Mamona ransomware activities.

Impact

For European organizations, particularly healthcare providers, the impact of GLOBAL GROUP's ransomware campaign could be severe. Healthcare entities often operate legacy systems with known vulnerabilities and may have limited cybersecurity resources, making them prime targets. Successful ransomware attacks can lead to encryption of critical patient data, disruption of healthcare services, and potential violations of GDPR due to data breaches or loss of availability. The AI-driven negotiation tool increases the likelihood of ransom payments, potentially encouraging further attacks. The mobile control panel allows affiliates to operate with agility, increasing the speed and scale of attacks. Disruption in healthcare can have direct consequences on patient safety and public health. Beyond healthcare, other sectors targeted may face operational downtime, financial losses, reputational damage, and regulatory penalties. The campaign's use of brute-force attacks against Microsoft Outlook and RDWeb portals also threatens organizations relying on these services for remote work, a common scenario in Europe. The Russia-based infrastructure and similarity to Mamona ransomware suggest a persistent threat actor with regional geopolitical implications, possibly complicating attribution and response efforts.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to the specific tactics of GLOBAL GROUP. First, strengthen perimeter defenses by patching and hardening edge appliances and remote access portals, including RDWeb and Microsoft Outlook services, to prevent brute-force intrusions. Enforce strong, complex password policies and implement multi-factor authentication (MFA) for all remote access points to mitigate credential-based attacks. Monitor for unusual login attempts and implement account lockout policies to reduce brute-force success. Engage in threat hunting for indicators of compromise such as the provided file hashes, IP addresses (e.g., 185.158.113.114, 193.19.119.4), and suspicious onion domains linked to the group. Deploy endpoint detection and response (EDR) solutions capable of identifying ransomware behaviors and lateral movement techniques. Regularly back up critical data with offline or immutable backups to ensure recovery without paying ransom. Train staff on phishing and social engineering awareness, as initial access brokers often leverage compromised credentials or phishing to gain entry. Given the AI-driven negotiation capability, organizations should prepare incident response plans that include legal and communication strategies to avoid impulsive ransom payments. Collaboration with national cybersecurity agencies and sharing intelligence on this threat can enhance collective defense. Finally, consider network segmentation to limit ransomware propagation and restrict affiliate control panel access through network monitoring and firewall rules.

Indicators of compromise

Domains 2

gdbkvfe6g3whrzkdlbytksygk45zwgmnzh5i2xmqyo3mrpipysjagqyd.onion
vg6xwkmfyirv3l6qtqus7jykcuvgx6imegb73hqny2avxccnmqt5m2id.onion

IP addresses 2

185.158.113.114
193.19.119.4

Hashes 10

4e01e0eca4d82cbadc70b754a4f9fd3c
e9c298008395e5dc18fbc4f8180dec58
dffec40e5723d9551c848cde5786d379fd734b8e
a8c28bd6f0f1fe6a9b880400853fc86e46d87b69565ef15d8ab757979cd2cc73
16bc5adc4f46cdf7c4852d17ebf9f499
2e339540ab604bb0b317fab1e61c99e44c09ce32
1f6640102f6472523830d69630def669dc3433bbb1c0e6183458bd792d420f8e
232f86e26ced211630957baffcd36dd3bcd6a786f3d307127e1ea9a8b31c199f
28f3de066878cb710fe5d44f7e11f65f25328beff953e00587ffeb5ac4b2faa8
b5e811d7c104ce8dd2509f809a80932540a21ada0ee9e22ac61d080dc0bd237d

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Jul 2025, 19:31 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 2

IP addresses 2

Hashes 10

Community reviews

Related threats