Analyzing GLOBAL GROUP (BlackLock) Artifacts

Malware News
1

Forecast Trends 2026 for ESXi Attacks in the Ransomware Ecosystem

In the rapidly evolving threat landscape of early 2026, ransomware operations have shifted dramatically toward high-impact infrastructure targets, with VMware ESXi hypervisors emerging as a prime vector for mass disruption. Ransomware groups like GLOBAL GROUP are one of those groups. It started all today with an technical analysis of a publicly shared X domain by the MalwareHunterTeam and the leak of the whole ecosystem of RAMP . The investigation centered on two specific file hashes that I’ve found with the associated command-and-control domains that together have strong attribution to the BlackLock ransomware-as-a-service (RaaS) operation, also known historically as Eldorado or El Dorado and later rebranded as GLOBAL GROUP. The first artifact is the SHA256 hash

 9b2637b8fefeedf8dca8a0ace491de05b6d937ea7463b48562cd1a0f25abb9f5

which corresponds to a malicious LNK file disguised as

 FAKE_CAPTCHA.lnk

This file serves as the initial social-engineering vector. The second is

 9d7e12eae6b593e582d8b2c3af3154a989977309dcffc7a85aedf0e047d4ca0b

,a loader detected heuristically as Fragtor by multiple antivirus engines. These components communicate with the domains

paksecurity[.]org

and

techoption[.]org

which function as fresh payload-hosting or C2 infrastructure for a potential campaign and leaked today.

Post-exploits would be likely hypervisor attacks

This ransomware group is part of a ecosystem documented extensively by reasearch teams like Mandiant in its M-Trends 2026 report. Mandiant’s frontline investigations across hundreds of incidents in 2025 revealed that ransomware operators systematically target virtualization management planes, backup infrastructure, and identity services to enforce “recovery denial” a strategy that forces victims into a binary choice between paying the ransom or undertaking a full rebuild from scratch. In 2025 alone, virtualization infrastructure was targeted in 43 percent of Mandiant-observed incidents, up sharply from 29 percent the prior year. Groups leveraging REDBIKE (Akira) and AGENDA (Qilin) ransomware were among the most prolific in exploiting the “Tier-0” privileges of hypervisors to bypass guest-level defenses entirely. By encrypting datastores directly on the hypervisor layer, attackers render dozens or even hundreds of virtual machines inoperable with a single payload execution, amplifying operational impact while evading endpoint detection and response (EDR) tools running inside guest operating systems.

The FAKE_CAPTCHA[.]lnk file employs classic social-engineering tactics, often distributed via phishing emails or fake support portals. When executed, the LNK triggers hidden PowerShell or command-line instructions that leverage living-off-the-land binaries (LOLBins) to drop the subsequent loader into a user-writable directory such as

C:\Users\Public\

The loader, flagged generically as Fragtor due to its obfuscation and behavioral patterns that are common in Microsoft Defender, Bitdefender, and other engines, establishes persistence through scheduled tasks and beacons to the aforementioned domains. These domains, which resolve to IPs such as

104[.]21[.]25[.]86 and 
23[.]62[.]168[.]204

in sandbox telemetry, host the next-stage payloads or serve as staging points for the final BlackLock encryptor.

GLOBAL GROUP (BlackLock/Eldorado)

Initial access via LNK droppers, followed by a Fragtor-style loader that facilitates lateral movement through Active Directory (AD) and eventual deployment of the cross-platform encryptor would be another intial access for the affiliates of this group. No other ransomware family has been publicly linked to this artifacts in open-source intelligence as of April 2026 but several sandboxes revealed Eldorado and Fragtor.

BlackLock itself traces its origins to March 2024 when it first appeared under the Eldorado banner on the now-seized Russian Anonymous Marketplace RAMP forum. The operation’s administrator, operating under the alias “$$$,” aggressively recruited affiliates by advertising high revenue splits, often reaching 85 percent for large ransoms and providing a custom Go-based builder capable of generating Windows, Linux, and ESXi encryptors. By late 2024, the group rebranded to BlackLock to distance itself from early scrutiny, then evolved again into GLOBAL GROUP around mid-2025. Infrastructure leaks, including exposed backend IPs hosted by Russian VPS providers such as IPServer, confirmed the continuity across these brands. The group’s data-leak site (DLS) activity surged dramatically, with a reported 1,425 percent quarter-over-quarter increase in Q4 2024 alone, cementing its position among the most prolific RaaS programs targeting U.S. and European organizations in sectors like healthcare, manufacturing, education, and government. The use of ChaCha20 (or XChaCha20) for per-file encryption, combined with RSA-OAEP for key wrapping and randomized extensions for e.g. .63npoxa6, remains consistent across variants.

Hypervisor ESXi Attacks

Placing this in the wider context of 2026 ransomware activity reveals a seismic shift toward hypervisor-centric attacks. Traditional endpoint encryption has become less efficient as organizations improved guest-level defenses. Attackers recognized that hypervisors represent a single point of failure. One compromised ESXi host can encrypt an entire virtualized estate in minutes. M-Trends 2026 explicitly highlights this evolution, noting that ransomware intrusions now frequently target virtualization management planes to achieve “recovery denial.” In one documented pattern, threat actors first obtain Domain Admin privileges through credential dumping or pass-the-hash, then pivot to domain-joined ESXi hosts. A particularly effective technique CVE-2024–37085 allows any member of a specially named AD group to receive full administrative rights on the hypervisor without additional authentication. Ransomware operators simply create the “ESX Admins” group via net group commands and add their controlled account, granting instant ESXi admin access. This method was observed in high-tempo operations linked to Medusa affiliates (Storm-1175) and has been adopted by multiple groups deploying Akira and Black Basta payloads. Research on UNC3944 (Scattered Spider) further underscores the risk, detailing how social-engineering-driven initial access can lead directly to hypervisor encryption when combined with these TTPs.

Technical Playbook for ESXI Attacks

The technical playbook for ESXi attacks now includes several well-documented variations, each optimized for different initial-access vectors. In the phishing-driven path exemplified by the known BlackLock campaigns in the past, the FAKE_CAPTCHA.lnk could now initiate the chain, the Fragtor loader in our example could handle persistence and C2, and the Go-based encryptor with the -esxi flag could be deployed after AD compromise. The encryptor enumerates datastores on

 /vmfs/volumes/

issues

esxcli vm process kill — type=hard

commands to shut down running VMs, and then encrypts .vmdk and .vmx files using the group’s proprietary scheme. Ransom notes such as

 HOW_RETURN_YOUR_DATA.TXT

would be dropped in every directory, and backups are systematically deleted via vssadmin or WMI to prevent restoration. A second variation relies on public-facing application exploits, such as VPN or firewall zero-days, followed by lateral movement via PsExec or WMI to domain controllers. Once Domain Admin is achieved, attackers use GPOs or direct SSH to push the encryptor.

A third, more stealthy approach exploits VM guest escapes, such as the CVE-2025–22225 chain involving HGFS and VMCI interfaces, allowing code execution on the hypervisor from within a compromised guest VM. There are observed automated portions of these deployments in multiple incidents, indicating maturing toolkits that reduce manual effort.

What about Hyper-V Attacks?

Hyper-V attacks, by contrast, remain far less mature and less prevalent than their ESXi counterparts. While ESXi benefits from native Linux-based encryptors that run directly on the bare-metal hypervisor, Hyper-V targets are almost always attacked from the Windows Server host itself using PowerShell cmdlets such as Stop-VM and direct encryption of .vhdx files. Groups like Akira and The Gentlemen have experimented with Hyper-V support, but dedicated bare-metal lockers are rare. Hyper-V is more frequently abused for stealth by advanced persistent threats (APTs) rather than ransomware operators, who prefer the higher ROI of ESXi’s one-to-many encryption model.

AD Compromise

In 2025–2026 data, ESXi accounted for the overwhelming majority of hypervisor ransomware incidents, with Hyper-V appearing primarily in opportunistic Windows-centric environments. The core shared TTPs across both AD compromise, credential access via LSASS dumping or Kerberoasting, and pre-encryption data exfiltration via Rclone, highlight how ransomware groups standardize their playbooks regardless of the final target platform.

Ransomware-related intrusions constituted 13 percent of all investigations in 2025, with a clear trend toward industrialized, fast hand-offs Attackers sometimes transfer access to affiliates in as little as 22 seconds. Virtualization targeting rose sharply because hypervisors offer an unmonitored “Tier-0” layer where traditional EDR has limited visibility. The recommendation is treating hypervisors as critical assets equivalent to domain controllers, citing examples where groups like Scattered Spider pivoted from help-desk social engineering straight into vSphere estates. AI-assisted negotiation tools and multilingual recruitment on successor forums after the RAMP seizure in January 2026, shows still activity in the BlackLock/GLOBAL GROUP’s affiliate ecosystem.

Who else is using ESXi?

Other prolific actors like LockBit 5.0, DragonForce, Qilin, Play, Medusa, and The Gentlemen follow nearly identical ESXi and AD playbooks, differing mainly in initial access like phishing LNKs versus IAB credentials and encryptor language like Go versus Rust. The net result is a homogenized threat ecosystem where any successful affiliate can leverage the same high-impact techniques.

A new campaign or just an affiliate testing?

Beyond the immediate technical findings, the paksecurity[.]org and techoption[.]org domains represent classic OPSEC hygiene failures common in RaaS operations. Sandbox analysis shows these domains hosting multiple malicious files, consistent with BlackLock’s affiliate model of rapidly spinning up fresh infrastructure to evade blocklists. The low public visibility of these domains at the time of the MalwareHunterTeam post suggests an active, low-volume campaign still in the reconnaissance or early deployment phase. Cross-referencing with known BlackLock indicators, randomized extensions, ChaCha20 encryption, and the specific LNK-Fragtor chain would not leave doubt about attribution but need further approval. While the tweet’s speculative “Maybe some APT…” comment generated brief discussion, no evidence supports nation-state involvement. All indicators point to financially motivated Russian-speaking criminals operating under the “$$$” alias on underground forums. Further research on similar campaigns reinforces that financially motivated actors now dominate hypervisor attacks, with state-sponsored groups like those deploying BRICKSTORM malware using ESXi for persistence rather than encryption.

The broader implications for organizations are profound

A single ESXi compromise can halt entire business operations, as seen in retail, healthcare, and manufacturing incidents throughout 2025. Modern ransomware is no longer merely about data theft and encryption but about destroying recoverability. Attackers compress and archive virtual hard disks directly on hypervisors, bypassing guest DLP controls, then encrypt at the datastore level. This forces victims into lengthy rebuilds from immutable backups if they exist. The 2026 landscape also features increased use of zero-days, such as the CVE-2025–22225 VM escape chain, and legacy vulnerabilities like CVE-2024–37085 that remain unpatched in many environments. Aggressive affiliate recruitment, combined with easy-to-use builders, lowers the barrier for entry, meaning even less sophisticated actors can execute sophisticated hypervisor attacks.

Not joining AD to vCenter

Effective defense requires a layered, proactive strategy grounded in hardening guidance and real-world observations. First, organizations must treat ESXi hosts as Tier-0 assets equivalent to domain controllers. The advise is to not joining ESXi hosts directly to Active Directory instead, manage all access exclusively through vCenter roles and permissions with least-privilege principles.

Enable lockdown mode, enforce signed binaries only, and disable unnecessary services. The vCenter Hardening Script released by Mandiant automates many of these controls at the Photon Linux layer. Second, implement network segmentation. Isolate hypervisor management networks from general AD traffic and monitor for anomalous esxcli, vim-cmd, or SSH connections. Third, deploy immutable backups stored offsite or in air-gapped environments, with regular testing of restore procedures. Fourth, enhance detection through behavioral analytics focused on AD group creation especially “ESX Admins”, unusual PowerShell execution on management servers, and unexpected file encryption patterns on /vmfs/volumes/. Tools that monitor vCenter audit logs and ESXi hostd processes are critical. Fifth, conduct regular vulnerability management, prioritizing VMware patches for CVE-2024–37085. Sixth, invest in user awareness training to counter phishing LNK campaigns like the FAKE_CAPTCHA[.]lnk observed here, and enforce multi-factor authentication everywhere, including on vendor portals and remote access solutions. Finally, develop and rehearse incident response playbooks specifically for hypervisor compromise, including rapid isolation of affected hosts and forensic preservation of datastores.

In conclusion, the analysis of hashes

 9b2637b8fefeedf8dca8a0ace491de05b6d937ea7463b48562cd1a0f25abb9f5

and

 9d7e12eae6b593e582d8b2c3af3154a989977309dcffc7a85aedf0e047d4ca0b

paired with domains paksecurity[.]org and techoption[.]org, reveals an active BlackLock/GLOBAL GROUP intrusion vector that embodies maybe the 2026 ransomware threat model. Hypervisor attacks are no longer niche but a core component of industrialized ransomware operations, driven by recovery-denial tactics and enabled by standardized playbooks across groups like Akira, Qilin, LockBit, and GLOBAL GROUP itself. The technical sophistication of these campaigns, combined with the ease of affiliate participation, demands that organizations elevate virtualization security to the forefront of their risk management programs. By implementing recommended hardening measures, maintaining immutable backups, and fostering a culture of continuous monitoring and response, enterprises can significantly reduce their exposure to these high-impact threats.

GLOBAL GROUP MITRE ATT&CK TTPs

GLOBAL GROUP, as the direct continuation of BlackLock/Eldorado/Mamona operations under the same “$$$” administrator, exhibits a highly standardized and mature set of tactics, techniques, and procedures (TTPs). These are derived from real-world observations in 2025 campaigns and includes new IOC for the LNK and Fragtor chain in the samples above.

TA0001 — Initial Access

  • T1566.001 Phishing (Spearphishing Attachment/Link): FAKE_CAPTCHA[.]lnk social-engineering vector
  • T1190 Exploit Public-Facing Application: Observed in affiliate campaigns targeting VPNs, Citrix, or other edge devices.
  • T1133 External Remote Services: RDP/VPN brute-force or stolen credentials from IABs.
  • T1078 Valid Accounts (T1078.001 Default Accounts / T1078.002 Domain Accounts): Heavy reliance on IAB-provided Domain Admin credentials or default ESXi service accounts like vpxuser.

TA0002 — Execution

  • T1059.001 Command and Scripting Interpreter: PowerShell: Hidden commands in the LNK dropper and loader stage.
  • T1203 Exploitation for Client Execution: Used in initial LNK execution and loader behavior.
  • T1569.002 System Services: Service Execution: For persistence and payload delivery.

TA0003 — Persistence

  • T1053 Scheduled Task/Job: Core technique in the Fragtor loader to create tasks for beaconing and execution.
  • T1543.003 Create or Modify System Process: Windows Service: Observed in some affiliate payloads.

TA0004 — Privilege Escalation

  • T1068 Exploitation for Privilege Escalation: Combined with AD group manipulation.
  • T1098 Account Manipulation: Creation of the “ESX Admins” domain group to gain instant ESXi admin rights (CVE-2024–37085 technique).

TA0005 — Defense Evasion

  • T1027 Obfuscated Files or Information: Fragtor heuristic detection on the loader. Go-based obfuscation in encryptors.
  • T1562.001 Impair Defenses: Disable or Modify Tools: Process termination and EDR/AV bypass via BYOVD in some variants.

TA0006 — Credential Access

  • T1550.002 Use Alternate Authentication Material: Pass the Hash (PtH): Core lateral movement technique post-AD compromise.
  • T1110 Brute Force: Occasional VPN/credential attacks.

TA0007 — Discovery

  • T1135 Network Share Discovery: SMB scanning for lateral movement and ESXi host enumeration.

TA0008 — Lateral Movement

  • T1021.002 SMB/Windows Remote Services: PtH-enabled SMB access to domain-joined ESXi hosts.

TA0040 — Impact

  • T1486 Data Encrypted for Impact: Go-based ESXi encryptor (-esxi flag); stops VMs with esxcli vm process kill or vim-cmd, then encrypts .vmdk/.vmx on /vmfs/volumes.
  • T1490 Inhibit System Recovery: Stealthy shadow-copy deletion via in-memory COM object and WMI/shellcode. It also deletes snapshots and Recycle Bin.
  • T1105 Ingress Tool Transfer: Loader downloads final encryptor from C2 domains like paksecurity[.]org/techoption[.]org.

These TTPs are near-universal across GLOBAL GROUP affiliates because the RaaS builder and toolkit enforce consistency.

Recommended Detection Analytics

Organizations can detect GLOBAL GROUP activity early by focusing on behavioral analytics rather than static IOCs alone. The following detection opportunities are prioritized for the observed campaigns:

  1. LNK and Fake CAPTCHA Social Engineering: Monitor for execution of .lnk files named with “CAPTCHA”, “FAKE”, or similar themes from email/web downloads. Correlate with PowerShell spawned from explorer.exe or rundll32.exe.
  2. Fragtor Loader Behavior: Look for PE files triggering generic “Fragtor” heuristics (Microsoft Defender: Trojan:Win32/Fragtor!MSR) dropping to %PUBLIC% or %TEMP%, followed by schtasks.exe creation of persistence tasks.
  3. Anomalous vpxuser Logons (ESXi Pivot): Alert on ESXi host authentication events where the source user agent is not “VMware-client” or “VMKernel” (ReliaQuest rule). Flag any non-VMware client accessing vpxuser.
  4. “ESX Admins” Group Creation: Real-time monitoring for net group “ESX Admins” /add or equivalent LDAP modifications on domain controllers.
  5. PtH Lateral Movement: Detect NTLM hash usage (Event ID 4624 with Logon Type 3 and unusual source) targeting ESXi management IPs.
  6. Shadow Copy Deletion: Query for vssadmin delete shadows /all or WMI COM object creation followed by Volume Shadow Copy Service manipulation.
  7. ESXi-Specific File/Process Activity: Monitor /vmfs/volumes/ for rapid creation of .HOW_RETURN_YOUR_DATA.TXT notes or high-volume file modifications matching ChaCha20 patterns (unusual entropy and randomized extensions). Alert on esxcli vm process kill or vim-cmd vmsvc/power.off executed from non-admin SSH sessions.
  8. C2 Domain Beaconing: Blocklist and alert on paksecurity[.]org, techoption[.]org, or similar low-reputation .org domains resolving to Cloudflare/Edge IPs in the context of unusual outbound traffic from loaders.
  9. Mutex and Builder Artifacts: Hunt for mutex “Global\Fxo16jmdgujs437” (or variants) in memory/process creation, a strong GLOBAL GROUP fingerprint reused from Mamona/BlackLock.

Analyzing GLOBAL GROUP (BlackLock) Artifacts was originally published in Detect FYI on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Article Link: https://detect.fyi/analyzing-global-group-blacklock-artifacts-72dabc14c500?source=rss----d5fd8f494f6a---4