Parsing: enabled
Known RaaS
Description
Now a RaaS by BlackLock ($$$).
Global Group is a newly emerged Ransomware-as-a-Service (RaaS) platform that debuted in June 2025 on the Ramp4u cybercrime forum. Marketed as a successor to the Mamona and BlackLock ransomware families, it leverages a Golang-based, cross-platform payload that supports execution on Windows, macOS, and Linux. This group stands out by incorporating AI-driven chatbots to manage victim negotiations, promoting scalability and efficiency—even for affiliates lacking language skills. Within its first weeks of operation, Global Group claimed numerous victims across industries such as healthcare, automotive services, and facilities management, located in the U.S., U.K., Australia, and Brazil.
External Analysis6
| External Analysis |
|---|
| https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service |
| https://cybersecurity-magazine.com/news/ransomware-ai-chatbot-pressure/ |
| https://infosecurity-magazine.com/news/ransomware-group-uses-ai-chatbot/ |
| https://broadcom.com/support/security-center/protection-bulletin/global-a-new-blacklock-ransomware-variant |
| https://picussecurity.com/resource/blog/tracking-global-group-ransomware-from-mamona-to-market-scale |
| https://cyware.com/news/global-group-ransomware-claims-breach-of-media-giant-albavision |
Ransom notes1
Mail1
| globalteam@cyberfear.com |
Session1
| Session |
|---|
| 0532b290d16a48f8f81dc1a41c0840145aede477af674c56e6599507aa7f27933c |
Urls1
| Url | ||||
|---|---|---|---|---|
| http://vg6xwkmfyirv3l6qtqus7jykcuvgx6imegb73hqny2avxccnmqt5m2id.onion/ | Down |
|
File servers1
| Url | ||||
|---|---|---|---|---|
| http://7bmz2tc4p2jk23dcyehg37cd7veflk3fyhxrnbxz75vvno2azfy6qayd.onion/ | Down |
|
Chat servers2
| Url | ||||
|---|---|---|---|---|
| http://panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onion/ | Down |
|
||
| http://gdbkvfe6g3whrzkdlbytksygk45zwgmnzh5i2xmqyo3mrpipysjagqyd.onion/ | Down |
|
Activity (interactive) 33
Posts33
| Date | Title | Description | Screen |
|---|---|---|---|
| awmedicalvillage.org | |||
| hmsaojose.com | |||
| RUKU Tore - Türen | |||
| Albavision.tv | |||
| Albavision | |||
| CONTRAQI | |||
| Cyme Servicios Médicos | |||
| Dithelm Travel Group | |||
| Geomaticks Grecia | |||
| Medical Village LIV | |||
| MukundRhotindian | |||
| Rete Toscana Classica | |||
| RTE | |||
| lafavoritaservice.it | |||
| moelco.es | |||
| loraincountyauditor.gov | |||
| Emphail.com | |||
| entab.se | |||
| Rosewood Farm | |||
| Morpeth Pharmacy | |||
| Letry | |||
| Skyline Dubuque | |||
| Fenol Kimya | |||
| Capitol Taxes | |||
| https://www.personalservice.com.br/ | |||
| Deakin Medical | |||
| ad-engineering.co.uk | |||
| Ascot Vale Health Group | |||
| TC Wilson | |||
| LS Proline | |||
| all-nations-health-center | |||
| Epworth-Hospital |
|
||
| www.motorworldarc.co.uk |
|