Global Group Ransomware Abuses WinMerge to Deploy Encryptor
Global Group ransomware uses WinMerge to deploy encryptor via payment-themed phishing.
Researchers at Cofense have uncovered a new tactic employed by the threat group Global Group. They are leveraging payment-themed phishing emails containing malicious ISO files that, when opened, utilize the legitimate WinMerge software to deploy their ransomware encryptor. This method targets large enterprises, aiming to extort them through ransomware attacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run WinMerge?
Get an email when a new story names WinMerge, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Global Group threat actors are exploiting trusted, legitimate software (WinMerge) as a living-off-the-land technique to bypass security controls and deploy ransomware, initiated through payment-themed phishing emails carrying malicious ISO files. This attack chain is particularly dangerous because security tools may whitelist WinMerge, allowing the encryptor to execute without triggering alerts. The use of ISO files is a deliberate evasion tactic to bypass email attachment scanning and mark-of-the-web (MotW) protections. Targeting large enterprises amplifies the potential for massive extortion payouts, making employee phishing awareness and endpoint configuration controls critical defensive layers.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Global Group ransomware