GLOBAL GROUP RaaS Adds AI-Powered Negotiation Feature for Ransom Demands

GLOBAL GROUP RaaS Adds AI-Powered Negotiation Feature for Ransom Demands A newly surfaced Ransomware-as-a-Service operation, dubbed GLOBAL GROUP, has begun deploying an AI‐driven negotiation tool that elevates the psychological pressure on victims and streamlines extortion workflows for affiliates. Security researchers at EclecticIQ first identified GLOBAL GROUP’s activity in early June on the Ramp4u underground forum, where the threat actor known as “$$$” shared an onion link to a dedicated leak site and touted a forthcoming full-service RaaS platform. Subsequent analysis suggests that GLOBAL GROUP represents a rebranding of the Black Lock RaaS operation, itself the successor to the now-defunct Mamona ransomware, all under the direction of the same actor. GLOBAL GROUP’s infrastructure relies heavily on Initial Access Brokers (IABs) who sell footholds in high-value corporate networks. These brokers provide remote access via compromised VPN appliances—most notably Fortinet, Palo Alto, a...