Hackers Deliver Global Group Ransomware Offline via Phishing Emails

Researchers at Forcepoint X‑Labs uncovered a global phishing campaign (active 2024–2025) where Phorpiex-distributed .lnk shortcuts drop Global Group ransomware. The malware leverages Living-off-the-Land (PowerShell/CMD), generates encryption keys locally (offline 'mute' mode) using ChaCha20-Poly1305, removes evidence (self-delete, VSS deletion), and appends a .Reco extension to encrypted files; common IOCs include Document.doc.lnk, windrv.exe, a 127.0.0.7 ping timer, and the ransom note wallpaper.