Case global-group-ai-negotiatorAI-assisted malwareUnited States
GLOBAL GROUP RaaS deploys AI chatbot negotiators to press seven-figure ransoms
EclecticIQ found the BlackLock rebrand GLOBAL GROUP running an AI-driven chatbot in its ransom negotiation panel so non-English affiliates could pressure victims; one affiliate demanded 1 million USD within 48 hours.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 15, 2025
- Location
- United States
- Target
- 17 victims incl. US and Australian healthcare, UK industry
- Severity
- High
- Triggered by
- GLOBAL GROUP (actor $$$, ex-BlackLock and Mamona)
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
EclecticIQ found the BlackLock rebrand GLOBAL GROUP running an AI-driven chatbot in its ransom negotiation panel so non-English affiliates could pressure victims; one affiliate demanded 1 million USD within 48 hours.
Impact: 17 claimed victims in six weeks, mostly healthcare; ransom demands up to 1 million USD.
Who triggered it
Actor: GLOBAL GROUP (actor $$$, ex-BlackLock and Mamona)
Attribution: EclecticIQ, medium confidence that GLOBAL GROUP is a BlackLock rebrand and high confidence that $$$ runs it, based on shared mutex, infrastructure and qTOX name change.
Motive: Financial extortion with 80 percent affiliate payouts
How it happened
Attack vector: Initial access brokers selling edge-appliance and RDP access, Go-based multi-platform encryptor, AI chatbot negotiation portal
Root cause: AI negotiation automation removed language barriers for affiliates and scaled extortion pressure
Timeline
- GLOBAL GROUP promoted on Ramp4u forum
- Group announces GLOBAL RaaS officially released
- Victim count reaches 17 across US, UK, Australia and Brazil
- EclecticIQ publishes analysis
Response
EclecticIQ published indicators; no law enforcement action reported.
Current status: Ongoing
Sources (open in a new tab)
- EclecticIQ blog.eclecticiq.com
- The Hacker News thehackernews.com
- Axios axios.com
Cite this case
GLOBAL GROUP RaaS deploys AI chatbot negotiators to press seven-figure ransoms. AI Threat Watch, case global-group-ai-negotiator, Jul 15, 2025. https://aithreat.io/cases/global-group-ai-negotiator/
Permanent link: https://aithreat.io/cases/global-group-ai-negotiator/