Phorpiex Phishing Campaign Delivers GLOBAL GROUP Ransomware

Summary

A high-volume phishing operation relies on malicious Windows shortcut (LNK) attachments to run a small downloader that retrieves GLOBAL GROUP ransomware. When opened, the shortcut spawns cmd.exe, which then calls PowerShell to pull a second-stage payload from an attacker-hosted IP. The ransomware saves itself as windrv.exe, encrypts data with the .Reco extension, and removes its own traces to hinder detection. GLOBAL GROUP runs fully offline, generating keys locally and never contacting external C2 for key exchange at all.

Investigation

Researchers reviewed an attachment named Document.doc.lnk that masked a weaponized shortcut. Running it launches cmd.exe and PowerShell to download spl.exe and lfuck.exe from 178.16.54.109, then saves the result as %userprofile%windrv.exe. The ransomware encrypts files, drops README.Reco.txt, creates a mutex, and erases itself while creating a scheduled task called CoolTask. Persistence is reinforced by copying to %windir%Tempcleanup.exe and registering a Windows service that re-launches the payload at system startup.

Mitigation

Email gateways should block .lnk attachments and flag double-extension filenames. On endpoints, watch cmd.exe and PowerShell chains that download executables directly from external IPs. Enable script logging and restrict PowerShell to signed scripts only. Add behavior detections for the GlobalFxo16jmdgujs437 mutex, creation of the CoolTask scheduled task, and sudden appearance of .Reco-encrypted files. Keep network blocklists current for 178.16.54.109 and update hash-based detections for spl.exe and lfuck.exe.

Response

If activity is detected, disconnect the host and stop the running ransomware processes. Delete windrv.exe and remove any related services or the CoolTask scheduled task. Recover affected data from backups only after confirming full eradication. Preserve command-line and log evidence for forensics, then update SIEM/EDR rules with the collected IOCs across the environment.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands

1. Preparation: The attacker has obtained the ransomware payload (gg.exe) and stores it in C:Tempgg.exe.
2. Execution Wrapper: Using a batch‑style command line, the attacker launches cmd.exe, which in turn spawns a PowerShell instance that calls Start-Process to run the payload.
3. Timing Delay: To mimic the ransomware’s “sleep” behavior, the same command line appends a ping -n 3 127.0.0.1 call (approximately a 2‑second delay).
4. Result: A single process creation event is emitted with a command line containing cmd.exe, powershell.exe, Start-Process, and ping -n 3. This matches the Sigma rule’s three required substrings.

Regression Test Script

# -------------------------------------------------
# Global Group Ransomware Execution Simulation
# -------------------------------------------------
# Prerequisite: Ensure C:Tempgg.exe exists (dummy file for test)
if (-not (Test-Path "C:Tempgg.exe")) {
    New-Item -Path "C:Tempgg.exe" -ItemType File -Force | Out-Null
}

# Craft the combined command line
$combinedCmd = 'cmd.exe /c "powershell.exe -Command `"Start-Process -FilePath C:Tempgg.exe`" & ping -n 3 127.0.0.1"'

# Execute the command (this will generate a single 4688 event)
Invoke-Expression $combinedCmd

# Optional: Write a marker to the console for test tracking
Write-Host "[+] Global Group Ransomware simulation executed."

Cleanup Commands

# Remove the dummy ransomware file
Remove-Item -Path "C:Tempgg.exe" -Force

# (Optional) Clear any lingering PowerShell jobs – not needed for this simple test
Write-Host "[+] Cleanup completed."

End of Report