A newly emerged ransomware-as-a-service (RaaS) operation, known as GLOBAL GROUP, is gaining attention in the cybersecurity community for its use of artificial intelligence to automate victim negotiations. The group’s deployment of AI chatbots represents a significant evolution in ransomware operations, increasing both scalability and psychological pressure on targeted organizations.
A High-Tech Twist on Cyber Extortion
GLOBAL GROUP first surfaced in June 2025 and is believed to be a rebrand or evolution of previous ransomware groups, Black Lock and Mamona, based on shared infrastructure and code similarities. Now operating under a new name, the group is leveraging sophisticated automation tools, including AI chatbots embedded within its web-based negotiation portals hosted on the dark web.
Victims are directed to these portals following an attack, where they must interact directly with the chatbot—which now mediates the ransom process without requiring a human operator. The chatbot is programmed to collect encrypted files for verification, deliver ransom demands, manage timers, and escalate threats if payments are delayed.
Psychological Pressure Meets Machine Efficiency
The use of AI-driven negotiations marks a strategic shift in the ransomware landscape. The chatbot not only facilitates 24/7, multilingual communication but also applies consistent psychological pressure. Key tactics include:
- Countdown Timers: Designed to instill a sense of urgency, reinforcing the threat of permanent data loss or leaks.
- Escalation Threats: Warnings of sensitive data publication on a leak site increase fear and compliance pressure.
- Transactional Efficiency: Human emotion is removed from the equation, resulting in cold, calculated interactions that leave little room for empathetic engagement or stalling.
Security analysts note that this type of automation allows the group to manage a higher volume of victims concurrently while maximizing the emotional impact of negotiations.
A Broader Trend in Cybercrime
Experts believe GLOBAL GROUP’s embrace of artificial intelligence is part of a growing trend in which ransomware developers seek to scale operations and increase profit margins through technological automation. AI tools previously confined to defensive cybersecurity use cases—such as threat detection and analytics—are now being repurposed by adversaries.
“The automation of hostage negotiations using AI bots is a game-changer,” said Elena Miles, Threat Intelligence Director at CyberWatch Global. “What we’re seeing is the industrialization of ransomware. These groups are adopting enterprise-level efficiency and operational sophistication.”
