Dark Web Profile: GLOBAL Ransomware

GLOBAL Ransomware, also known as the GLOBAL GROUP, emerged in mid-2025 as a RaaS operation on the Russian Anonymous Marketplace (RAMP), with forensic links to earlier families such as Mamona and BlackLock. According to SOCRadar, it offers affiliates an unusually high share of 80 to 85 percent of ransom payments and provides features including a mobile-friendly management panel, an offline builder, and an AI-powered negotiation chatbot, emphasising its affiliate-driven model.

Investigators regard GLOBAL as a rebrand of BlackLock, which evolved from Eldorado, with a strategy that combines RaaS with initial access brokers and external partners specialising in initial access brokerage; its operations have focused on critical sectors such as healthcare, energy, oil and gas, and manufacturing across the U.S., Ireland, Belgium, the U.K., Australia and Brazil, with the United States accounting for nearly half of known incidents.

The malware is a Go-based monolithic binary that runs on Windows, Linux, VMware ESXi, BSD, macOS and NAS devices, supports multi-threaded encryption, and can spread automatically across domains, aided by manual and automated lateral movement tactics. Victims typically face ransom notes directing them to a Tor-based negotiation portal, with three days to respond and demands that have exceeded one million dollars.