Mamona

Mamona is a ransomware brand assessed to be part of a financially motivated cybercriminal ecosystem and later linked through operational-security overlaps to the BlackLock and GLOBAL GROUP ransomware operations. Reporting indicates Mamona functioned within the ransomware-as-a-service landscape and shared infrastructure and operator tradecraft with those successor or related brands, including reuse of the same forum persona and malware implementation artifacts. Mamona is therefore best understood not as an isolated actor but as one stage in an evolving ransomware lineage that rebranded over time. The group has been associated with leak-site operations and extortion activity characteristic of modern ransomware campaigns. High-confidence reporting ties the Mamona lineage to data theft prior to encryption, threats to publish stolen information, aggressive ransom negotiations, and affiliate-driven intrusions. Related operations in the same lineage supported cross-platform encryption against enterprise environments including Windows, virtualization platforms, network-attached storage, and BSD systems, and used techniques such as credentialed propagation through directory services, token impersonation, defense evasion, shadow-copy deletion, log clearing, and anti-analysis measures. Initial access in the linked ecosystem has been associated with phishing, use of initial access brokers, and password-spraying or brute-force activity against remote access services. Mamona has also been notable as a target of rival ransomware actors. In 2025, DragonForce reportedly defaced infrastructure associated with Mamona and leaked some internal communications during broader criminal-on-criminal conflict in the ransomware ecosystem. Known related names in this lineage include BlackLock and GLOBAL GROUP.