[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVaMBJQBMIXTK_WxvhGsJ2SgXCVQc1vQf9EOonZ8VHF4":3},{"article":4,"iocs":40,"watch_terms":44,"solutions":45,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"3fb38a49-67e4-4fba-b84d-e8cdefd91678","Global Group Ransomware Abuses WinMerge to Deploy Encryptor","global-group-ransomware-abuses-winmerge-to-deploy-encryptor-c396c8","Cofense researchers reveal how Global Group uses payment-themed phishing, malicious ISO files and WinMerge to deploy ransomware and extort large enterprises.","Researchers at Cofense have uncovered a new tactic employed by the threat group Global Group. They are leveraging payment-themed phishing emails containing malicious ISO files that, when opened, utilize the legitimate WinMerge software to deploy their ransomware encryptor. This method targets large enterprises, aiming to extort them through ransomware attacks.","Global Group ransomware uses WinMerge to deploy encryptor via payment-themed phishing.","https:\u002F\u002Fhackread.com\u002Fglobal-group-ransomware-winmerge-deploy-encryptor\u002F",null,"2026-09-30T15:44:45+00:00","2026-09-30T16:00:11.736028+00:00",8,[17,20],{"name":18,"type":19},"Global Group","threat_actor",{"name":21,"type":22},"WinMerge","product","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":23,"icon":12,"name":25,"slug":26},"Ransomware","ransomware",[28,30,35],{"category":29},{"id":23,"icon":12,"name":25,"slug":26},{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41],{"type":34,"value":42,"context":43},"Global Group ransomware","Ransomware deployed by the threat actor",[21],{"controls":46,"vendors":130},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":77,"name":78,"problem":79,"products":80},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,124],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":114,"url":115,"description":116},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":106,"product_name":121,"url":122,"description":123},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":148},"global-group-abuses-legitimate-winmerge-tool-to-deploy-ransomware-via-phishing","Global Group Abuses Legitimate WinMerge Tool to Deploy Ransomware via Phishing","The Global Group threat actors are exploiting trusted, legitimate software (WinMerge) as a living-off-the-land technique to bypass security controls and deploy ransomware, initiated through payment-themed phishing emails carrying malicious ISO files. This attack chain is particularly dangerous because security tools may whitelist WinMerge, allowing the encryptor to execute without triggering alerts. The use of ISO files is a deliberate evasion tactic to bypass email attachment scanning and mark-of-the-web (MotW) protections. Targeting large enterprises amplifies the potential for massive extortion payouts, making employee phishing awareness and endpoint configuration controls critical defensive layers.",[136,137,138,139,140,141,142,143,144,145,146,147],"CIS Control 9: Email and Web Browser Protections","CIS Control 10: Malware Defenses","CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 IR-4: Incident Handling","MITRE ATT&CK T1566.001: Phishing – Spearphishing Attachment","MITRE ATT&CK T1553.005: Subvert Trust Controls – Mark-of-the-Web Bypass","MITRE ATT&CK T1218: System Binary Proxy Execution (Living off the Land)","ITIL: Problem Management – Root Cause Analysis for Recurring Phishing Incidents",{}]