global
Known ransomware group Dormant / low-volume
GLOBAL GROUP is a ransomware-as-a-service operation that emerged in June 2025, reportedly launched by a known Russian-speaking threat actor, featuring AI-driven ransom negotiation and a mobile control panel for affiliates, targeting healthcare, oil and gas, industrial engineering, and automotive sectors.
2
Total Claims
0
Critical
—
Records Claimed
2
Industries Hit
Active span: Sep 12, 2026 – Sep 12, 2026 · 2 organizations targeted
Dormant / low-volume
Actor Threat Profile
Activity Timeline
Peak: Sep 2026 (2)Sep 2026
LessMore
Sep 2026Share this profile
Top Targeted Industries
Education 1
Government & Defense 1
Tradecraft & Infrastructure
0
Documented tools
0 / 0
MITRE tactics / techniques
5
Known leak sites