Global

Global is a cross-platform ransomware family that emerged in 2025 and has been associated with the branding lineage of Mamona and BlackLock. It is positioned as a multi-environment locker with support for Windows, Linux, and VMware ESXi, reflecting the broader shift among ransomware operators toward targeting both enterprise endpoints and virtualization infrastructure for maximum operational disruption. Public reporting has described Global as a rebrand introduced under the name GLOBAL GROUP and tied to earlier ransomware identities, indicating continuity in operator tradecraft despite changes in public branding.

Global is used for data-extortion and encryption operations consistent with modern ransomware campaigns. It has been referenced in activity affecting multiple regions, including a 2026 campaign in which a Global-like payload was selectively deployed after checking victim geolocation, demonstrating target filtering prior to payload delivery. The family has been discussed in the context of the fragmented ransomware ecosystem of 2025, where operators frequently rebrand, reuse established playbooks, and expand beyond Windows into Linux and ESXi environments.

The malware is relevant to defenders monitoring ransomware threats against enterprises, especially organizations operating mixed Windows and virtualized server estates. Its reported lineage and cross-platform capability suggest an operator focused on continuity, adaptability, and high-impact disruption across heterogeneous infrastructure.