File · global · Crime · ransomware.live · refreshed 2026-10-06
global
- Global Cybernetic Collective
sigil · no ATT&CK coverage stated
Last 30 days
last seen 12 d agoWhat changed
ledger · newest first- 2026-09-3018 d agonew alias1 new alias: Global Cybernetic Collective
- 2026-09-161 mo agovictimsvictim count 4 → 6 (+2)
Analyst brief
ransomware.liveGLOBAL GROUP is a ransomware-as-a-service operation that emerged in June 2025, reportedly launched by a known Russian-speaking threat actor, featuring AI-driven ransom negotiation and a mobile control panel for affiliates, targeting healthcare, oil and gas, industrial engineering, and automotive sectors.
Observed targets (as stated by the sources)
3 countries · 5 sectorsassessed originnot stated by sourcesobserved targets · 3
countries · 3
- China
- United States
- Uruguay
sectors · 5
- Technology
- Education
- Government & Defense
- Transportation
- Healthcare
as stated by MISP galaxy / ransomware.live — not inferred
Detections
7 rules · Sigma · QRadar · CortexIndicator
Known-malicious file hash observedAPT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Indicator
Malicious HashesAPT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Generated by skopnix from this finding, each with false-positive notes. Open the list →
Victims
leak-site listings via ransomware.live| Victims observed | First observed | Last observed on leak site | Lifetime rate | Last 30 days |
|---|---|---|---|---|
| 6 | ≈ 6.0 / month | below the lifetime rate 4 |
- Victims observed
- 6
- First observed
- Last observed on leak site
- Lifetime rate
- ≈ 6.0 / month
- Last 30 days
- below the lifetime rate 4
lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew
Primary-source reports
via APTnotes · linked, never re-hosted- 2022Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networkscisa ↗
- 2020This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple ExploitsFireeye ↗
- 2019AVIVORE - Hunting Global Aerospace through the Supply ChainContextis ↗
- 2018Dark Caracal Cyber-espionage at a Global ScaleLookout ↗
- 2018https://securingtomorrow.mcafee.com/blogs/other-blogs/mcafee-labs/operation-sharpshooter-targets-global-defense-critical-infrastructure/McAfee ↗
- 2017Cyber Espionage is Alive and Well: APT32 and the Threat to Global CorporationsFireEye ↗
Take it with you
keyless · no signupReferences
1 sourceTrack global on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.