Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new Ransomware-as-a-Service (RaaS) group called GLOBAL GROUP has emerged, likely a rebranding of the BlackLock RaaS operation. The group targets various sectors across the US and Europe, with a focus on healthcare providers. GLOBAL GROUP utilizes Initial Access Brokers to gain entry to vulnerable edge appliances and employs brute-force tools for Microsoft Outlook and RDWeb portals. Their ransom negotiation panel features AI-driven chatbots, enabling non-English-speaking affiliates to engage victims more effectively. The group offers an 85% revenue share to affiliates and provides a mobile-friendly control panel. GLOBAL GROUP's infrastructure has been traced to a Russia-based VPS provider, and their operations show similarities to previous Mamona ransomware activities.

The GLOBAL GROUP ransomware-as-a-service (RaaS) campaign represents a sophisticated evolution in ransomware operations, likely a rebranding of the previously known BlackLock RaaS. This group targets multiple sectors across the US and Europe, with a pronounced focus on healthcare providers, a sector known for critical data and operational sensitivity. GLOBAL GROUP leverages Initial Access Brokers (IABs) to gain footholds in victim networks, specifically exploiting vulnerable edge appliances. They also employ brute-force attacks targeting Microsoft Outlook and RDWeb portals, common vectors for remote access and email compromise. A notable innovation in their operation is the integration of AI-driven chatbots within their ransom negotiation panel, which facilitates multilingual communication and enables affiliates who may not be fluent in English to negotiate effectively with victims. This AI-enhanced negotiation capability likely increases the success rate of ransom payments by improving communication and persuasion. The group offers an attractive 85% revenue share to affiliates, incentivizing widespread participation. Additionally, GLOBAL GROUP provides a mobile-friendly control panel, enhancing operational flexibility for affiliates to manage campaigns remotely. Their infrastructure is hosted on a Russia-based VPS provider, and their tactics and infrastructure bear resemblance to the Mamona ransomware group, suggesting possible shared resources or lineage. The campaign employs a broad range of tactics, techniques, and procedures (TTPs) including brute-force (T1110), exploitation of remote services (T1190), persistence mechanisms (T1505.003), and ransomware deployment (T1486). Indicators of compromise include multiple file hashes, IP addresses, and onion domains used for command and control or ransom negotiation. Although no known exploits are currently reported in the wild, the campaign's use of brute-force and initial access brokers indicates a high likelihood of successful intrusions where security controls are weak or outdated.

Detailed information about Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates. Get real-time updat

Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'black lock'

Filter Threats

Threats Tagged 'black lock'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility