Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Global
As of Oct 19, 2026, Global has listed 33 confirmed victims on its leak site since Jun 2, 2025, 0.1% of all victims tracked by Brandefense. Its most targeted country is United States (27.3% of its victims) and its most targeted sector is Healthcare.
GLOBAL GROUP is a ransomware-as-a-service operation that emerged in June 2025, reportedly launched by a known Russian-speaking threat actor, featuring AI-driven ransom negotiation and a mobile control panel for affiliates, targeting healthcare, oil and gas, industrial engineering, and automotive sectors.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 33
- Rank By Victims
- #130
- Last Leak-Site Post
- Sep 12, 2026
- Top Country
- United States
- Top Sector
- Healthcare
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 4 |
| September 2026 | 2 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 4 |
| September 2026 | 2 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| June 2025 | 14 |
| July 2025 | 10 |
| August 2025 | 3 |
| September 2025 | 0 |
| October 2025 | 0 |
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 4 |
| September 2026 | 2 |
| October 2026 (month in progress) | 0 |
Latest Global Victims.
Search all 33 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| Sutton Public Schools suttonschools.net | USUnited States | Education and Research | 532.98 GB | |
| TOWN OF SUTTON | MASSACHUSETTS suttonma.gov | USUnited States | Government and Public Sector | 178 GB | |
| Atcomm atcomm.cn | CNChina | Technology | Not stated | |
| Shanghai Tunnel Engineering Co Ltd stecs.com.sg | SGSingapore | Transportation and Logistics | Not stated | |
| Hangzhou Qihan Biotech Co., Ltd. qihanbio.com | CNChina | Healthcare | Not stated | |
| Vigilia vigilia.com.uy | UYUruguay | Technology | Not stated |
How They Operate.
Global's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Global Targets.
Sectors
History.
First seen in Brandefense data
Busiest month on record: 14 confirmed victims
First confirmed victim listed on its leak site
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.