GreenBlood Ransomware File Encryption - .tgbg/.bak Extension and Ransom Note Drop

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects GreenBlood ransomware activity by monitoring for the creation of its specific ransom note file ('READ_ME_TO_RECOVER_FILES.txt') and the renaming of files to its characteristic encrypted extensions ('.tgbg' or '.bak'). The rule aggregates these events by device and process, triggering an alert if a ransom note is dropped or if more than 5 files are renamed with the ransomware's extensions.