From Payment Plan to Ransomware – Inside a Global Group Attack

Summary

Global Group, a rebrand of Black Lock and Mamona, operates a sophisticated Ransomware-as-a-Service (RaaS) platform. The group uses double extortion tactics, stealing sensitive information before encrypting systems to increase financial pressure on victims. It also relies on Initial Access Brokers to bypass perimeter defenses and target large enterprises worldwide.

Investigation

The Cofense Phishing Defense Center investigated a campaign in which attackers distributed a fake Suggested Payment Plan email containing a malicious PDF attachment. The document redirected victims to a download site serving an ISO file that contained a malicious executable and LNK file. The infection chain then abused the legitimate WinMerge.exe process to retrieve the final ransomware encryption payload.

Mitigation

Organizations should deploy robust email filtering to detect suspicious PDF attachments and messages sent from generic or untrusted domains. Endpoint security should restrict unauthorized ISO and LNK file execution. Security teams should also monitor for unusual child processes or network activity originating from legitimate applications such as WinMerge.exe.

Response

If Global Group activity is detected, affected systems should be isolated immediately to prevent lateral propagation of the encryption payload. Responders should conduct a full forensic investigation to determine the initial entry point and identify potential data exfiltration. Access logs should also be reviewed for compromised credentials, and the organization’s ransomware incident response plan should be activated.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained access to a developer’s workstation. To avoid suspicion, they use WinMerge.exe (a legitimate file comparison tool) to launch enc.exe (a mock encryption binary). By using a trusted binary as the parent process, they hope to evade simple “suspicious parent” detections. The goal is to trigger the specific WinMerge.exe -> enc.exe logic defined in the detection rule.

• Regression Test Script:

  # 1. Create a dummy 'enc.exe' to simulate the ransomware component
  $dummyEncPath = "$env:TEMPenc.exe"
  $code = @"
  using System;
  namespace DummyEnc {
      class Program {
          static void Main() {
              Console.WriteLine("Encryption Process Started...");
          }
      }
  }
  "@
  Add-Type -TypeDefinition $code -OutputAssembly $dummyEncPath -OutputType ConsoleApplication
  
  # 2. Locate WinMerge (assumes it is in PATH or common location)
  $winMergePath = Get-Command WinMerge.exe -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Source
  if (-not $winMergePath) {
      Write-Error "WinMerge.exe not found in PATH. Please ensure it is installed for this simulation."
      return
  }
  
  # 3. Execute the attack sequence: WinMerge -> enc.exe
  Write-Host "Starting Simulation: Launching WinMerge to call enc.exe..."
  Start-Process -FilePath $winMergePath -ArgumentList $dummyEncPath
  
  # Allow time for process creation to be logged
  Start-Sleep -Seconds 5
  Write-Host "Simulation complete."

• Cleanup Commands:

  # Remove the dummy encryption binary
  Remove-Item -Path "$env:TEMPenc.exe" -Force -ErrorAction SilentlyContinue
  Write-Host "Cleanup complete."