Phorpiex Phishing Delivers Low-Noise Global Group Ransomware

A widespread phishing campaign uses deceptive Windows Shortcut (.lnk) attachments named like documents to launch cmd.exe and PowerShell, downloading a Phorpiex-associated payload that ultimately deploys Global Group ransomware; the ransomware operates offline, encrypts files with ChaCha20-Poly1305 (appending .Reco), drops README.Reco.txt, replaces desktop wallpaper, deletes shadow copies, and self-deletes, complicating detection and recovery.