The Global ransomware group is a ransomware-as-a-service operation that emerged in mid-2025, linked to the earlier BlackLock group through shared infrastructure and malware traits. It uses a sophisticated affiliate model with features such as a negotiation portal, mobile management, and AI-assisted victim communication. The malware is written in Go and employs ChaCha20-Poly1305 encryption, targeting Windows, Linux, ESXi, and NAS platforms. The group supports double extortion by deploying a custom stealer named WorldThief, which operates quietly and selectively exfiltrates data. Access is primarily gained via purchased credentials and exploitation of edge devices from major vendors. The group’s activity spans at least 18 countries. An exposed backend IP address revealed ties to a Russian VPS provider, highlighting a lapse in their operational security. This profile underscores the persistence and evolution of ransomware operations through rebranding and infrastructure reuse.

The Global ransomware group conducts ransomware attacks across multiple operating systems and network-attached storage devices, encrypting victim data with strong encryption and employing double extortion tactics by stealing data with a custom stealer. Their mature affiliate program and advanced victim communication tools increase the efficiency and scale of their operations. The group’s reliance on purchased access and exploitation of widely used edge devices increases the attack surface and potential victim pool. Their activity affects organizations in over 18 countries, indicating a broad geographic impact. The reuse of infrastructure from previous ransomware groups suggests that existing indicators of compromise (IOCs) related to BlackLock may still be relevant for detection and defense.

No official patch or remediation is applicable as this is a threat actor profile rather than a software vulnerability. Defenders should leverage existing IOCs related to BlackLock and monitor for indicators associated with the Global group. Organizations should ensure strong credential hygiene, patch and secure edge devices (Fortinet, Palo Alto, Cisco), and monitor for signs of purchased access or unusual authentication activity. Incident response teams should be aware of the group’s use of double extortion and the WorldThief stealer. Since no vendor advisory or patch is available, follow vendor guidance for securing affected infrastructure and apply best practices for ransomware defense relevant to the exploited vectors.