Global Group Ransomware Rebranding Analysis

This technical report provides an analysis of the Global Group ransomware operation, including its history, victimology, and technical capabilities. The report outlines the emergence of Global Group in June 2025, detailing its connection to previous ransomware operations such as Black Lock and Mamona Rip, promoted by the user ‘$$$’ on the RAMP cybercriminal forum. The report highlights a shift in targeting, with the health sector becoming a primary focus, contrasting with previous operations. It also presents a technical analysis of the ransomware's capabilities, including lateral movement within networks and encryption functions. Additionally, the report discusses the infrastructure associated with Global Group, linking it to IP SERVER LLC in Russia. The report concludes with actionable content, including indicators of compromise and recommendations for mitigating risks associated with this ransomware operation. The analysis aims to provide a comprehensive understanding of the evolving threat landscape posed by ransomware actors.