7 mincritical
From Payment Plan to Ransomware - Inside a Global Group Attack
Global Group ransomware, rebranded from Black Lock and Mamona, uses phishing PDFs to deliver ISO payloads via DLL side-loading through WinMerge, encrypting files with .nZASJgT extension under double extortion. The attack chain starts with a phishing email containing a PDF attachment that redirects to a malicious URL downloading an ISO file. The ISO contains an EXE and LNK pair that spawns WinMerge.exe for DLL side-loading. WinMerge beacons to C2 servers, downloads enc.exe, which disables security tools, scans drives and network shares, and encrypts files with .nZASJgT extension. The group employs double extortion with a Tor leak site.
Sens:■ Immediate
IOCs22
5md55sha2563domain3ip3url2file path1email
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block driverupdate.sbs, globalsupportupdate.top, and playmounthdom.top at DNS and proxy.
- Quarantine emails from [email protected] and similar payment plan lures.
- Isolate systems showing .nZASJgT encrypted files or C:\Python27.x86 payload drops.
- Block IPs 104.21.92.70, 172.67.175.15, 172.67.188.157 at firewall.
Key Takeaways
- Global Group rebrands Black Lock and Mamona ransomware, partnering with Initial Access Brokers for enterprise access.
- Phishing email uses 'Suggested Payment Plan' lure from [email protected] with PDF attachment.
- ISO file bypasses Mark-of-the-Web, containing EXE and masqueraded LNK shortcut.
- WinMerge.exe used for DLL side-loading; beacons to playmounthdom.top, downloads enc.exe from globalsupportupdate.top.
- Encrypted files use .nZASJgT extension; ransom note is README.nZASJgT.txt; Tor leak site listed.
Attack Chain
- Initial Access: Phishing email with "Suggested Payment Plan" PDF attachment from [email protected]
- Execution: PDF download button redirects to driverupdate.sbs, downloading Preview-9dc7.iso
- Defense Evasion: ISO contains EXE and LNK masquerading as PDF; EXE spawns WinMerge.exe
- C2: WinMerge.exe beacons to playmounthdom.top, downloads enc.exe from globalsupportupdate.top
- Impact: enc.exe disables security, scans drives, encrypts files with .nZASJgT, drops ransom note
Affected Systems
- Windows endpoints targeted via phishing email with PDF attachment
- Network file shares scanned and encrypted by ransomware payload
- Database systems scanned by encryptor during encryption phase
- Large-scale enterprise environments across multiple industries
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | WinMerge.exe execution, ISO mounting, file encryption, and process termination are EDR-observable. |
| Network Visibility | High | HTTPS C2 connections to attacker domains and payload downloads visible in proxy and DNS logs. |
| Detection Difficulty | Moderate | C2 uses Cloudflare IPs shared with benign traffic; domain-based hunting is more effective than IP blocking. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| WinMerge.exe or WinMergeU.exe making outbound HTTPS connections to non-standard domains (T1071.001) | EDR process network connections and proxy logs | Command and Control | Medium — WinMerge used legitimately in dev environments |
| Executable files dropping toolkits and scripts to Python installation directories (T1105, T1059.006) | EDR file write events and process execution logs | Execution | Low — Python installs via package managers not executables |
| LNK shortcut files masquerading as PDF documents inside mounted ISO images (T1036) | EDR file creation and ISO mount events | Initial Access | Low — legitimate PDFs are not LNK files |
| Security tool processes being terminated before mass file encryption activity begins (T1562.001, T1486) | EDR process termination and file rename events | Impact | Low — security tool termination before encryption is anomalous |
Required Log Sources
- EDR process execution and network connection logs
- Proxy logs for HTTPS traffic
- Email gateway attachment scanning logs
- DNS resolution logs
- File system audit logs for mass rename
- Windows Event Logs for ISO mount events
Key Behavioral Indicators
- WinMerge.exe or WinMergeU.exe making outbound HTTPS connections
- File creation in C:\Python27.x86 by non-Python installer processes
- Mass file extension rename to .nZASJgT across multiple directories
- LNK files with PDF-like names inside mounted ISO images
- Desktop wallpaper changed to ransom note image
- enc.exe downloaded and executed from external HTTPS URL
Control Gaps
- DNS filtering may not block newly registered C2 domains fast enough
- Email gateway may miss PDF-with-download-button lure pattern
- ISO execution bypasses Mark-of-the-Web protections on Windows
- DLL side-loading via WinMerge not caught by application allowlisting
- Security tool disabling may not alert before encryption completes
False Positive Assessment
Medium — C2 IPs are Cloudflare shared infrastructure; WinMerge is a legitimate tool with outbound connections in dev environments.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block ISO file attachments and downloads at email gateway and web proxy.
- Enable Mark-of-the-Web enforcement for downloaded files via Group Policy.
- Restrict WinMerge.exe execution to approved users and disable if unnecessary.
- Deploy application allowlisting to prevent enc.exe and ptc1591.exe execution.
User Protection
- Alert users about payment plan phishing emails with PDF attachments.
- Train staff to report emails from Hotmail domains claiming payment plans.
- Disable auto-mounting of ISO files on Windows endpoints.
- Deploy EDR rules detecting WinMerge.exe outbound network connections.
Security Awareness
- Train users to verify payment plan emails through internal finance channels.
- Warn users about downloading files from email-suggested external websites.
- Educate staff on double extortion ransomware tactics and data leak threats.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Discovery
Tactic
Command and Control
Plain-Language Summary
Criminals send fake payment plan emails with a PDF attachment. Clicking the download button in the PDF fetches a disguised malware file. When opened, it uses a legitimate-looking file comparison tool (WinMerge) to secretly download and run encryption software. The software locks files by adding a .nZASJgT extension and displays a ransom note demanding cryptocurrency payment. The criminals also threaten to publish stolen data online. Organizations should block the listed malicious websites and email addresses and train staff to recognize suspicious payment-related emails.
Additional IOCs
- Domains:
driverupdate[.]sbs- Payload delivery domain hosting malicious ISOglobalsupportupdate[.]top- C2 domain hosting encryptor payload enc.exe
- Urls:
hxxps://playmounthdom[.]top/- C2 URL receiving HTTPS POST beacons from WinMergevg6xwkmfyirv3l6qtqus7jykcuvgx6imegb73hqny2avxccnmqt5m2id.onion- Tor hidden service data leak site for Global Group
- File Hashes:
2abd445d3d60fd207b2c62bb0da3a42b(MD5) - Phishing PDF attachment document_989399.pdf00F70AE018E71F51060346AAA101209C24E34697BBFAFEC6B3612DB8D8127CB2(SHA256) - ISO container Preview-9dc7.iso with EXE and LNK9DB4B94589728B68D51BF83A90211CFE(MD5) - ISO container Preview-9dc7.iso with EXE and LNK5DEE17E91F79BE742881324BCDF139A5(MD5) - Loader executable Preview-9dc7.exe inside ISO64388CDBFE48DCFF05EAA455892BCB3BFCAA3D43559EB7C65F6AC772810BE61E(SHA256) - LNK shortcut Preview-9dc7.pdf.lnk masquerading as PDF1E2C4CD35987EE217994149675784F9F(MD5) - LNK shortcut Preview-9dc7.pdf.lnk masquerading as PDF20417846820741fa84c4571affb40e9c(MD5) - Additional payload executable ptc1591.exe
- File Paths:
C:\Python27.x86- Ransomware toolkit and scripts drop directoryC:\Python27.x86\DLLs- Subdirectory containing encrypted payload files
- Other:
.nZASJgT- File extension appended to encrypted victim files
Showing defanged values
- domaindriverupdate[.]sbsPayload delivery domain hosting malicious ISO
- domainglobalsupportupdate[.]topC2 domain hosting encryptor payload enc.exe
- domainplaymounthdom[.]topC2 beacon domain contacted by WinMerge.exe
- emailhaloffuhodo[@]hotmail[.]comPhishing sender email for payment plan lure
- file_pathC:\Python27.x86Ransomware toolkit and scripts drop directory
- file_pathC:\Python27.x86\DLLsSubdirectory containing encrypted payload files
- ip104[.]21[.]92[.]70C2 IP for globalsupportupdate.top encryptor download
- ip172[.]67[.]175[.]15Payload delivery IP for driverupdate.sbs
- ip172[.]67[.]188[.]157C2 IP for playmounthdom.top beacon domain
- md51e2c4cd35987ee217994149675784f9fLNK shortcut Preview-9dc7.pdf.lnk masquerading as PDF
- md520417846820741fa84c4571affb40e9cAdditional payload executable ptc1591.exe
- md52abd445d3d60fd207b2c62bb0da3a42bPhishing PDF attachment document_989399.pdf
- md55dee17e91f79be742881324bcdf139a5Loader executable Preview-9dc7.exe inside ISO
- md59db4b94589728b68d51bf83a90211cfeISO container Preview-9dc7.iso with EXE and LNK
- sha25600f70ae018e71f51060346aaa101209c24e34697bbfafec6b3612db8d8127cb2ISO container Preview-9dc7.iso with EXE and LNK
- sha25664388cdbfe48dcff05eaa455892bcb3bfcaa3d43559eb7c65f6ac772810be61eLNK shortcut Preview-9dc7.pdf.lnk masquerading as PDF
- sha256997cf28771fde81c6bfc067eed1f19d0ad3554342d63d9469d3adcdc1ca0ff31Loader EXE inside ISO spawns WinMerge for side-loading
- sha2569fb468a79f88d9a250180749bfae97d4f310c8510f1f98cae359d95c2a62b4afAdditional payload executable ptc1591.exe
- sha256d5004e079cb46db15a7d0b7ecebfa47bb8a1bc19e25749849a017b2a36705260Initial phishing PDF attachment document_989399.pdf
- urlhxxps://driverupdate[.]sbs/access[.]php?t=notes-a408dfStage 1 payload delivery URL for ISO download
- urlhxxps://globalsupportupdate[.]top/enc[.]exeC2 URL downloading encryptor payload enc.exe
- urlhxxps://playmounthdom[.]top/C2 URL receiving HTTPS POST beacons from WinMerge