Mamona

Mamona is a ransomware family associated with the same criminal ecosystem behind BlackLock and later Global Group, and appears to have been used as an intermediate rebrand in that lineage during 2025. Reporting links Mamona to the operator alias "$$$" and to ransomware-as-a-service activity advertised on Russian-language criminal forums. Operational overlaps with Global include shared infrastructure patterns and reuse of the same mutex value, indicating close code or operator continuity rather than a merely nominal relationship.

Mamona targets enterprise environments and is tied to extortion operations that combine data theft with file encryption. Its successor lineage demonstrates capabilities including deletion of shadow copies, anti-analysis measures, multithreaded encryption, custom ransom-note deployment, and pressure tactics centered on leaking stolen data. Campaigns associated with the Mamona-to-Global transition have used phishing-delivered malware chains in which deceptive Windows shortcut attachments and living-off-the-land execution led to ransomware deployment. Mamona has also been discussed in connection with BlackLock affiliates, Embargo-linked activity, and later intersections with DragonForce-related operations, reflecting the fluid affiliate and rebranding dynamics common in the contemporary ransomware ecosystem.

Mamona is best understood as a short-lived ransomware brand within a broader financially motivated RaaS cluster that evolved from BlackLock and was subsequently rebranded as Global Group. Victimology associated with that cluster includes healthcare and manufacturing organizations, though Mamona itself is primarily notable for its role in that lineage rather than for uniquely documented technical distinctions.