Global Group Ransomware Abuses WinMerge to Deploy Encryptor

A Ransomware-as-a-Service operation called Global Group is targeting large enterprises with phishing emails that lead to a malicious ISO; the ISO drops an executable that abuses the legitimate WinMerge application to download and run an encryptor which appends the .nZASJgT extension, changes the desktop wallpaper, and drops a ransom note while also exfiltrating data for double extortion. Cofense observed the campaign, documented filenames and domains (e.g., driverupdate.sbs, globalsupportupdate.top, Preview-9dc7.iso, README.nZASJgT.txt), and recommends searching for these IOCs to identify infections.