Cofense researchers have identified a new tactic employed by the Global Group ransomware gang that targets large enterprises. The group uses payment-themed phishing emails to lure victims into downloading malicious ISO files. Once these files are executed, they deploy WinMerge, a legitimate file comparison tool, to facilitate the encryption of files on the victim's system. This technique allows attackers to bypass some security measures, making detection more difficult. The implications of this attack are significant, as it highlights the evolving methods ransomware groups are using to infiltrate corporate environments and extort money from organizations.