Green Blood is a Go-based file encryptor that first appeared in January 2026 and is run by a crew calling itself the Green Blood Group. It adds .tgbg to every encrypted file and writes !!!READ_ME_TO_RECOVER_FILES!!!.txt. Some builds also show a lock screen. The note gives a Recovery ID that starts with GREEN-BLOOD-, a Machine ID and a Proton Mail contact, and it asks for payment in Bitcoin. The note claims AES-256 encryption. Victims are mostly English-speaking, and spread so far is low. The crew has a Tor leak page listed by ransomware trackers, but no independent analysis has confirmed data theft. No lineage to an earlier family has been established.
File extensions: .tgbg
Ransom note filenames: !!!READ_ME_TO_RECOVER_FILES!!!.txt
Decryptor: Decryptor availability has not been recorded.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161