the green blood group

Executive Summary

The Green Blood Group is a medium‑sophistication criminal organization whose primary motive is financial gain through ransomware and large‑scale data exfiltration, targeting critical sectors such as government, finance, telecommunications, and aviation across the Middle East and West Africa. Using social engineering, zero‑day exploits like FortiWeb CVE‑2025‑55182 and HPE OneView CVE‑2025‑37164, and advanced malware including Cobalt Strike beacons and AI‑steganographic tools, they execute multi‑phase attacks that culminate in encrypted data and widespread ransomware deployment.

Goals & Targeting

The group’s strategic objective is primarily financial gain through ransomware payouts and data exfiltration. Target selection focuses on organizations with high-value data in government, finance, telecommunications, defense, healthcare, manufacturing, critical infrastructure, aviation, hospitality, and gaming sectors, especially where legacy systems or insecure cloud migrations increase vulnerability. The actor leverages opportunistic exposures such as misconfigured cloud services to harvest credentials, then exploits zero‑days to gain elevated privileges, eventually executing ransomware and exfiltrating data to leverage for ransom or blackmail.

Key Capabilities

• Deploy encrypted Cobalt Strike beacon payloads fetched from domains m\.fasterxml\.org and fasterxml\.org
• Use DLL side‑loading via malicious svchosts.exe on Windows and deploy macOS update payloads
• Exploit FortiWeb CVE-2025-55182 (React2Shell) to gain initial access to web applications
• Employ Fast Reverse Proxy as a pivot tool for internal network reconnaissance and exfiltration
• Conduct social–engineering attacks through phishing emails, BSOD spoofing screens, and credential collection from unprotected cloud accounts
• Exploit HPE OneView CVE-2025-37164 to achieve full infrastructure control
• Deploy China Chopper web shells and Samurai-backdoor for persistence and lateral movement
• Use AI‑driven steganography (Tuoni malware) for covert data exfiltration
• Encrypt victim files with Green Blood Group ransomware v1/v2 while exfiltrating large volumes of data via Tor leak sites

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The Green Blood Group has demonstrated a pattern of targeted, multi‑phase campaigns that begin with exploitation of known vulnerabilities in critical infrastructure and culminate in ransomware deployment accompanied by massive data exfiltration. A notable operation against the Senegalese government’s identity card system spanned roughly one month in early 2026, resulting in the theft of ~139 TB of sensitive data that was publicly released via a Tor‑based leak site. These campaigns display high operational precision, including AI‑driven steganographic exfiltration and rapid pivoting through Fast Reverse Proxy. While currently only a few public cases exist, analysts expect similar tactics to recur across other sectors with poorly patched devices or misconfigured cloud environments.

IOC Patterns

• Domains m\.fasterxml\.org and fasterxml\.org used for downloading malicious payloads
• Malicious svchosts.exe execution on Windows endpoints
• CVE-2025-55182 (FortiWeb React2Shell) exploitation indicator
• Phishing emails spoofing Booking.com URL and content
• BSOD spoofing screens to trick users into installing malware
• China Chopper web shell installation files
• Samurai-backdoor deployment scripts
• Green Blood Group ransomware encryptor v1/v2 binary
• Tor-based data leak site hosting exfiltrated payloads
• AI‑steganographic artifacts identified in Tuoni malware

Recommended Actions

• Conduct comprehensive risk assessments before migrating to cloud environments and enforce strict security controls during migration
• Block or sandbox downloads from untrusted domains such as m\.fasterxml\.org and fasterxml\.org
• Patch FortiWeb devices to latest firmware to mitigate CVE-2025-55182 vulnerabilities
• Deploy monitoring for DLL side‑loading patterns like svchosts.exe on Windows endpoints
• Implement network segmentation and monitor traffic to detect and block Fast Reverse Proxy activity
• Enforce multi‑factor authentication for all cloud accounts
• Promptly patch HPE OneView to fix CVE-2025-37164
• Train staff to recognize phishing emails and BSOD spoofing lures
• Use endpoint detection and response tools to identify web shells and backdoors
• Block or quarantine known malicious domains, IPs, and Tor exit nodes linked with Green Blood Group
• Implement strict egress filtering to limit ransomware spread
• Monitor for AI‑based steganographic malware indicators and suspicious file obfuscation

Suggested Tags