Global is a ransomware-as-a-service group known for AI-driven ransom negotiation and a mobile control panel.
Global is a ransomware-as-a-service group that emerged in June 2025, reportedly launched by a known Russian-speaking threat actor. It primarily targets the healthcare, oil and gas, industrial engineering, and automotive sectors. The operation leverages AI-driven ransom negotiation and a mobile control panel for affiliates as key TTPs. Defenders should focus on hardening email-borne initial access vectors like phishing and monitor for unusual automated communication patterns indicative of AI-based negotiation tools.
GLOBAL GROUP is a ransomware-as-a-service operation that emerged in June 2025, reportedly launched by a known Russian-speaking threat actor, featuring AI-driven ransom negotiation and a mobile control panel for affiliates, targeting healthcare, oil and gas, industrial engineering, and automotive sectors.
Defenders should heighten vigilance against email-borne initial access vectors, particularly phishing.
AI-driven ransom negotiation and a mobile control panel for affiliates.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.