{
  "name": "Emerging Ransomware-as-a-Service, Supporting AI Driven Negotiation and Mobile Control Panel for Their Affiliates",
  "slug": "emerging-ransomware-as-a-service-supporting-ai-driven-negotiation-and-mobile-control-panel-for-their-affiliates",
  "description": "A new Ransomware-as-a-Service (RaaS) group called GLOBAL GROUP has emerged, likely a rebranding of the BlackLock RaaS operation. The group targets various sectors across the US and Europe, with a focus on healthcare providers. GLOBAL GROUP utilizes Initial Access Brokers to gain entry to vulnerable edge appliances and employs brute-force tools for Microsoft Outlook and RDWeb portals. Their ransom negotiation panel features AI-driven chatbots, enabling non-English-speaking affiliates to engage victims more effectively. The group offers an 85% revenue share to affiliates and provides a mobile-friendly control panel. GLOBAL GROUP's infrastructure has been traced to a Russia-based VPS provider, and their operations show similarities to previous Mamona ransomware activities.",
  "published": "2025-07-16T14:10:12+00:00",
  "created_at": "2025-07-16T14:10:12+00:00",
  "modified_at": "2025-07-16T17:24:58+00:00",
  "created_at_opencti": "2025-07-16T14:10:12+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-07-16",
    "ai-driven negotiation",
    "black lock",
    "cross-platform",
    "initial access brokers",
    "mamona",
    "mobile control panel",
    "ransomware-as-a-service",
    "vpn brute-force"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "193.19.119.4"
      },
      {
        "id": "",
        "name": "185.158.113.114"
      },
      {
        "id": "",
        "name": "vg6xwkmfyirv3l6qtqus7jykcuvgx6imegb73hqny2avxccnmqt5m2id.onion"
      },
      {
        "id": "",
        "name": "gdbkvfe6g3whrzkdlbytksygk45zwgmnzh5i2xmqyo3mrpipysjagqyd.onion"
      },
      {
        "id": "",
        "name": "b5e811d7c104ce8dd2509f809a80932540a21ada0ee9e22ac61d080dc0bd237d"
      },
      {
        "id": "",
        "name": "28f3de066878cb710fe5d44f7e11f65f25328beff953e00587ffeb5ac4b2faa8"
      },
      {
        "id": "",
        "name": "232f86e26ced211630957baffcd36dd3bcd6a786f3d307127e1ea9a8b31c199f"
      },
      {
        "id": "",
        "name": "1f6640102f6472523830d69630def669dc3433bbb1c0e6183458bd792d420f8e"
      },
      {
        "id": "",
        "name": "a8c28bd6f0f1fe6a9b880400853fc86e46d87b69565ef15d8ab757979cd2cc73"
      }
    ],
    "intrusion_sets": [
      {
        "id": "24337166-7dd2-41f0-9569-4a4b1de9ecf2",
        "name": "GLOBAL GROUP",
        "slug": "global-group"
      }
    ],
    "attack_patterns": [
      {
        "id": "ee82762a-2958-4901-aade-341277d9b410",
        "name": "T1078.004"
      },
      {
        "id": "4bbdf41c-817c-448a-9513-aaea6bfbe8b4",
        "name": "T1568"
      },
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "195d9773-4de3-4f61-b94d-a2b53cb65608",
        "name": "T1021.001"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "444de5e0-bd7f-4700-b700-26320057dd80",
        "name": "T1110"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "d9f271ed-7685-4362-b90d-f16a14102f39",
        "name": "T1489"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "67c697ce-a6cc-475f-9bee-e14c1bef7067",
        "name": "T1047"
      },
      {
        "id": "53c193a7-f726-4bd2-ae88-4019e2604adf",
        "name": "T1046"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Australia"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "Brazil"
      },
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Healthcare"
      }
    ]
  },
  "external_refs": [
    "https://blog.eclecticiq.com/global-group-emerging-ransomware-as-a-service",
    "https://otx.alienvault.com/pulse/6877cee47723c96cd1d54e25"
  ]
}