HACKERS DELIVER GLOBAL GROUP RANSOMWARE OFFLINE VIA PHISHING EMAILS

Summary from the TLDR InfoSec newsletter

Forcepoint X-Labs discovered the Phorpiex botnet delivering Global Group ransomware, a Mamona successor, via phishing emails containing .lnk files disguised as documents. It leverages living-off-the-land techniques using PowerShell and Command Prompt for payload delivery. The ransomware operates in a mute mode that generates encryption keys locally with ChaCha20-Poly1305 instead of contacting a C2 server, allowing it to encrypt files on offline machines and evade network-based detection. After encryption, the malware self-deletes, destroys Volume Shadow Copies, and appends a .reco extension to locked files, leaving minimal forensic artifacts.