Global Group Ransomware Recovery: The BlackLock Rebrand With AI Negotiators
Global Group was first promoted on 2 June 2025 on a criminal forum by the actor who also controls the BlackLock ransomware and earlier ran Mamona. EclecticIQ assesses that it is most likely a rebrand of BlackLock; researchers found shared hosting, a shared mutex and code overlap with Mamona, and the encryptor is written in Go like BlackLock's. ransomware.live counts about 40 victim claims.
AI chatbots in the negotiation
Global Group's negotiation panel uses AI-driven chatbots, which lets affiliates who do not speak the victim's language keep the pressure on, and negotiations continue even without a human operator. Published chat transcripts show demands of up to seven figures.
Global Group ransomware data recovery: what we recover
No public decryptor exists. We examine the encrypted SQL Server and Oracle databases, virtual disks and backups and recover the tables, virtual machines and files the encryptor did not reach, before you decide anything about the ransom. Keep the encrypted files and contact us for a free assessment. No data, no charge.
Veeam backups, SQL Server or Oracle databases encrypted by Global Group?
Ransomware groups go after the backup repository first. A .vbk or .vib file renamed by the ransomware is often not lost: large backup files are usually only partly encrypted, and the intact blocks can be verified and rebuilt into the virtual disks. The same holds for SQL Server MDF and BAK files and for Oracle datafiles and Data Pump exports: the rows the ransomware did not reach can be read directly. In real cases we rebuilt a 466 GB server disk from a 43 GB Akira-encrypted VBK, and recovered 98.8% of the rows from LockBit-encrypted SQL Server backups.
- Ransomware-encrypted Veeam VBK recovery →
- AS VBK Recovery Studio: free analysis of an encrypted VBK →
- Ransomware-encrypted SQL Server database recovery →
- AS SQL Recovery & Repair Studio: free analysis of an encrypted MDF or BAK →
- Ransomware-encrypted Oracle database recovery →
- NAS and RAID ransomware recovery →
- Ransomware-encrypted VMware VMDK recovery →
Global Group ransomware data recovery: contact us now
We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.
- ✓ Free assessment before you pay anything
- ✓ No data, no charge
- ✓ NDA on request
Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST