Tracking GLOBAL GROUP Ransomware from Mamona to Market Scale

This report analyzes the June 2025 emergence of the GLOBAL GROUP ransomware, concluding it is a rebrand of Mamona/Black Lock rather than a new actor; it documents Golang-based, cross-platform binaries using ChaCha20-Poly1305 encryption, a configurable affiliate builder, AI-driven negotiation portals, and operational mistakes that leaked backend infrastructure (including IP 193.19.119.4) and multiple IoCs. The analysis includes ransom note text, builder feature mappings to payload behavior, evidence of affiliate/IAB collaboration, and defensive recommendations for detection and validation.